Apache TomEE's embedded HTTP server does not invalidate the previous session identifier when the session ID changes, such as after user login. This session fixation vulnerability allows an attacker who can set a session ID in a victim's browser to hijack the victim's authenticated session. Users are advised to restrict network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions.
Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_session needs no authentication and returns a polling token, a confirmation URL that carries that token, and a confirmation code. When a signed-in user opens that URL and clicks Confirm, NervesHub.Accounts.verify_cli_session_token/2 creates an API token for the user's account and stores it on the login, and the next poll of GET /api/auth/cli_session/<token> returns it to whoever started the login.
The confirmation code is only displayed and is never compared with anything, so it cannot show that the person confirming is the one who started the login. The confirm form carries a CSRF token and the page cannot be framed, so the attacker has to persuade the user to open the link and click the button themselves.
This issue affects nerves_hub: from 2.5.0 before 2.5.3.
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiated flow, an attacker who obtains a legitimately issued, still-valid SAML response and its matching RelayState can resubmit the pair to /recipe/saml/callback before the assertion's NotOnOrAfter time; in the IdP-initiated flow, the assertion can be replayed without RelayState. The missing Response.InResponseTo check also permits an in-progress login to be completed with an assertion for a different identity and fails to enforce allowIDPInitiatedLogin=false. The callback does not validate Destination or SubjectConfirmationData Recipient and NotOnOrAfter, and each accepted callback mints a fresh, independently redeemable authorization code carrying the captured user's identity. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console.
CVE-2026-82840 is a session fixation vulnerability in Apache Wicket's authentication module. The flaw occurs because the session ID is renewed only on the first sign-in, not on subsequent authentications within an already signed-in session. This allows an attacker who can fix a session ID in a victim's browser to reuse that session after the victim re-authenticates without session renewal. The issue affects Apache Wicket versions 8.18.0 through 8.19.0, 9.23.0 through 9.24.0, and 10.9.0 through 10.11.0. Upgrading to versions 8.20.0, 9.25.0, or 10.12.0 resolves the vulnerability.
A vulnerability in python-social-auth's social-core prior to version 6.2.0 allows an attacker to bypass nonce validation in OpenIdConnectAuth. The nonce is stored globally rather than being bound to the browser session and OAuth state, enabling an attacker who obtains a victim's unused authorization code to impersonate the victim if DEFAULT_USE_PKCE is disabled. This issue is resolved in version 6.2.0.
OpenHuman versions before 0.56.0 are vulnerable to a cross-site request forgery (CSRF) attack on the unauthenticated GET /auth/telegram loopback callback. This flaw allows an attacker with an OpenHuman account to trick a user running the local core into switching their active session to the attacker's backend account, exposing sensitive agent actions, memory writes, and Telegram messages. The vulnerability is fixed in version 0.56.0.
CVE-2026-55682 is a high-severity vulnerability in LabRedesCefetRJ's WeGIA web manager for charitable institutions. Versions prior to 3.8.6 have a flaw in the session handling mechanism where an attacker-supplied PHPSESSID cookie is reflected in the Set-Cookie response with the internal database host name exposed as the cookie domain. This allows an attacker to hijack authenticated sessions if a victim uses the attacker-chosen session identifier. The issue affects all PHP pages and is fixed in version 3.8.6.
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 contain a critical authentication bypass vulnerability related to session fixation when the samlWeb-2.0 feature is enabled. This flaw allows an attacker to bypass authentication, potentially leading to full compromise of confidentiality and integrity without requiring user interaction.
AsyncHttpClient versions from 2.1.0 up to 2.16.1 and 3.0.0 up to but not including 3.0.14 have a session fixation vulnerability in the default ThreadSafeCookieStore. This flaw allows Secure cookies received over plaintext to be accepted and insecure cookies to overwrite or delete existing Secure cookies, enabling an attacker to manipulate cookie state sent to HTTPS origins. The issue is fixed in version 3.0.14.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent A-label normalization, locale-sensitive lowercasing, public-suffix host-only handling, and numeric or IP host checks allow one origin to store a cookie later sent to another origin. Applications sharing one client across trust domains can therefore receive attacker-injected cookies and may be exposed to session fixation. This issue is fixed in version 3.0.14.
CVE-2026-92414 is a critical session fixation and session reuse vulnerability in Apache Jackrabbit's WebDAV server. The flaw allows the server to attach a cached authenticated session based solely on matching certain header tokens (Lock-Token, TransactionId, SubscriptionId, If-header) without verifying credentials. This can lead to session reuse across different users. Versions 2.20.0 through 2.20.17, 2.22.0 through 2.22.4, and 2.23.0 through 2.23.5 are affected. Fixed versions are 2.20.18, 2.22.5, and 2.23.6.
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover.
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
CVE-2026-57179 is a session fixation vulnerability in python-social-auth's social-core component affecting versions prior to 5.0.0. The issue arises because the partial-pipeline resume mechanism accepted a partial token as a bearer credential without binding it to the originating browser session. This flaw could allow an attacker to initiate an authentication flow, obtain a valid partial token, and trick a victim's browser into resuming the attacker's authentication flow, effectively authenticating the victim as the attacker. The vulnerability affects applications using partial pipeline steps such as mail_validation or custom steps decorated with @partial. The issue was fixed in version 5.0.0 by binding partial pipeline resumes to the originating browser session.
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and the deployment to enable auth.google.enabled, auth.github.enabled, or the Slack integration. This issue is fixed in version 0.91.1.
Apache Airflow versions 3.3.0 and 3.3.1 contain a session fixation vulnerability where the system prioritizes a session cookie over an explicit Authorization Bearer token. This causes the API to authenticate the user based on the cookie rather than the token, leading to principal confusion and inaccurate audit logs. Exploitation requires an attacker to place a valid session cookie in the victim's browser, which is more feasible in environments sharing domains with other applications. The issue is fixed in version 3.3.2.
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor session cookie, place it in a victim's browser, and know the shared-note URL where the victim authenticates can reuse the fixed session after the victim enters the correct password and access that shared note. The main SysReptor login flow is not affected. This issue is fixed in version 2026.68.
CVE-2026-86688 is a session fixation vulnerability in the team-alembic ash_authentication library. The flaw allows an attacker who can plant a session identifier in a victim's browser to maintain an authenticated session after the victim logs in. This occurs because the library writes the authenticated subject into the existing session without renewing the session identifier, allowing the original identifier to persist through login and logout cycles. This affects versions from 0.2.0 up to but not including 4.15.0, and from 5.0.0-rc.0 up to but not including 5.0.0-rc.14.