Description
Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enables an attacker to fix a session ID
for a victim and later hijack the authenticated session.
This issue was fixed in version 3.17.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Bludit | Bludit | < 3.17.2 | 3.17.2 |
References
- https://cert.pl/posts/2026/03/CVE-2026-25099 third-party-advisory
- https://github.com/bludit/bludit/releases/tag/3.17.2 release-notes