CVE-2024-8643 is a session fixation vulnerability in ValeApp by Oceanic Software affecting versions prior to 2.0.0. The vulnerability enables attackers to fixate a session identifier, facilitating brute force and session hijacking attacks. The CVSS 4.0 base score is 9.3 (critical), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official remediation or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor patch release.

Successful exploitation allows attackers to hijack user sessions and perform brute force attacks, potentially compromising user accounts and sensitive data. The vulnerability affects confidentiality, integrity, and availability of the application. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider limiting exposure by restricting access to trusted networks and monitoring for suspicious session activity. Avoid using affected versions of ValeApp in high-risk environments if possible.