A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. (CVE-2026-82697)

The sambitraj Student-Management-System up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 contains a vulnerability in the session_start function that causes cookies to be set without the 'httponly' flag. This weakness corresponds to CWE-732 (Incorrect Permission Assignment for Critical Resource). The vulnerability can be exploited remotely but requires high complexity and no privileges or user interaction. The exploitability is difficult, and the vulnerability has been publicly disclosed. The rolling release nature of the product means no specific version numbers are available. The project has been informed but has not yet responded or issued a fix.

The vulnerability allows cookies to be set without the 'httponly' flag, which could increase the risk of client-side script access to session cookies, potentially leading to session hijacking under certain conditions. However, the CVSS score of 3.7 (low severity) and the lack of impact on integrity or availability indicate limited impact. No known exploits are currently in the wild.

No official fix or patch is currently available, and the project has not responded to the issue report. Due to the rolling release model, users should monitor the project for updates or fixes addressing this vulnerability. Until a fix is provided, consider implementing additional application-level controls to protect session cookies, such as setting the 'httponly' flag manually if possible.