This vulnerability (CVE-2025-10228) in Agentis before version 4.44 is classified as CWE-384 (Session Fixation). It enables an attacker to set or fix a user's session ID, which can then be used to hijack the session after the user authenticates. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. No patch or remediation details are currently available, and the product is not a cloud service.

Successful exploitation allows an attacker to hijack user sessions, potentially gaining unauthorized access to sensitive information and performing actions with the victim's privileges. This impacts confidentiality, integrity, and availability of the affected system. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying temporary mitigations such as enforcing session regeneration after authentication if possible, and monitoring for suspicious session activity.