Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.

Published May 25, 2022 · Updated Jul 9, 2026 · Assigned by mitre