CVE-2026-55682: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in LabRedesCefetRJ WeGIA

WeGIA versions before 3.8.6 contain a session management vulnerability where the sessionStart.php script auto-prepends and reflects an attacker-controlled PHPSESSID cookie in the Set-Cookie header, using the internal DB_HOST as the cookie domain. This enables session fixation and hijacking attacks if a victim authenticates with the attacker-selected session ID. Additionally, the internal database host name is disclosed in the cookie domain attribute, exposing sensitive infrastructure information. The vulnerability impacts all PHP pages using this session handler. The vendor fixed the issue in version 3.8.6.

An attacker can hijack authenticated user sessions by forcing victims to use a session identifier chosen by the attacker, leading to unauthorized access. The exposure of the internal database host name in the cookie domain attribute leaks sensitive infrastructure information that could aid further attacks. The vulnerability affects confidentiality and integrity of user sessions but does not impact availability.

Upgrade WeGIA to version 3.8.6 or later, where this vulnerability is fixed. The fix addresses the improper handling of the PHPSESSID cookie and prevents exposure of the internal database host name. No other mitigations are specified or required once the patch is applied.