CVE-2026-86279: Session Fixiation in SourceCodester Syllabus-Aligned Learning Management & Examination System

SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 contains a session fixation vulnerability in the auth_process.php file within the Login component. This vulnerability allows an attacker to manipulate session identifiers remotely, enabling session fixation attacks. The CVSS 4.0 base score is 5.3, indicating medium severity. The vulnerability is publicly disclosed, but no confirmed exploits in the wild are known. No vendor advisory or patch information is provided, so remediation status is unknown.

Successful exploitation of this vulnerability could allow an attacker to fixate a session ID for a legitimate user, potentially gaining unauthorized access to the user's session and associated privileges. This could lead to unauthorized actions within the affected system. However, the impact is limited by the medium severity rating and the requirement for user interaction (UI:P).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing additional session management controls such as regenerating session IDs upon login and monitoring for suspicious session activity.