The vulnerability identified as CWE-384 in Toptech Systems TMS7 version 7.6.3 involves improper session management. Specifically, the application accepts session identifiers supplied by users and does not generate a new session ID upon successful authentication. This behavior permits an attacker to predetermine a session ID and hijack the session after the victim authenticates, leading to session takeover.

Successful exploitation allows an attacker to hijack authenticated sessions by reusing a predefined session ID, resulting in unauthorized access with the victim's privileges. The CVSS 3.1 score of 7.1 reflects high severity, with high confidentiality and integrity impact and low availability impact. The attack requires network access, high attack complexity, no privileges, and user interaction.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing compensating controls such as monitoring for suspicious session activity and enforcing additional authentication measures where possible.