CVE-2026-86674 describes a session fixation vulnerability in the ningzichun Student Management System affecting the session_start function in login.php. This vulnerability allows an attacker to manipulate session identifiers remotely, potentially hijacking user sessions. The product lacks versioning, so specific affected versions are unknown. The vulnerability was responsibly disclosed but remains unpatched, and public exploit code is available. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, user interaction required, and low impact on confidentiality, integrity, and availability.

An attacker can remotely fixate a session ID, potentially allowing unauthorized access to a victim's session. This could lead to user impersonation or unauthorized actions within the system. The impact is rated medium based on CVSS 4.0 with limited confidentiality, integrity, and availability impact.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor vendor communications for updates. Until a fix is provided, consider implementing additional session management controls such as regenerating session IDs after login and validating session tokens to mitigate exploitation risk.