By weakness (CWE)

CWE-384: related vulnerabilities

CVEs classified under CWE-384. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

10 published vulnerabilities

• CVE-2026-56425HIGH 8.8

  Azure Active Directory (AAD) Authentication Plugin for MISP contains serious flaws in how it handles OAuth 2.0 login flows. The plugin reuses PHP session identifiers as OAuth security tokens, which can leak through browser history and server logs—allowing attackers to steal active sessions. It also fails to rotate session IDs after login, leaves the authentication process vulnerable to replay attacks, permits unencrypted OAuth callbacks, and logs sensitive error data without sanitization. Together, these weaknesses could let an attacker hijack user sessions, forge login credentials, or tamper with audit records.

• CVE-2026-13707HIGH 7.6

  A session fixation vulnerability has been identified in Wikimedia Foundation's OAuth implementation that allows an attacker to hijack user sessions under specific conditions. Session fixation occurs when an attacker forces a user to use a known session identifier, then exploits that identifier to gain unauthorized access to the user's account. This vulnerability requires the attacker to have some level of access and the user to interact with a malicious link, but once successful, grants the attacker full access to the compromised account's permissions and data.

• CVE-2026-12581HIGH 7.5

  CVE-2026-12581 is a session fixation vulnerability in Digiwin's EasyFlow .NET application. An unauthenticated attacker can manipulate a user's session ID before that user logs in. Once the victim authenticates, the attacker gains full access to the user's account and privileges. The attack requires no special technical skill beyond intercepting or predicting the session token, and succeeds when a user takes the bait to log in with a compromised session already in place.

• CVE-2026-11335MEDIUM 6.3

  A session fixation vulnerability has been discovered in tittuvarghese CollegeManagementSystem. An attacker can manipulate the UserAuthData parameter in the login form to hijack a user's session, potentially gaining unauthorized access to college management functions without requiring strong authentication. The vulnerability is remotely exploitable and does not require special access—any unauthenticated user can attempt the attack. Public exploit code is available, increasing the practical risk.

• CVE-2026-14609MEDIUM 5.6

  CVE-2026-14609 is a session fixation vulnerability in SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0. An attacker can remotely manipulate an unknown processing component to hijack or lock a user's session, gaining unauthorized access to the account without needing to know the victim's password. The attack is complex to execute, requiring significant technical skill, but public exploit code now exists, raising the practical risk despite the moderate CVSS rating.

• CVE-2026-40082MEDIUM 5.4

  Cacti, a widely-deployed open source monitoring and management framework, contains a session fixation vulnerability in its login process. When users authenticate, the application fails to rotate the session identifier, allowing an attacker to potentially hijack authenticated sessions through same-site attack vectors. The flaw exists in versions 1.2.30 and earlier; version 1.2.31 and later address it. While the session cookie itself is well-configured with security flags (httpOnly, Strict SameSite, secure for HTTPS), the missing session ID regeneration leaves a window for exploitation during the critical authentication moment.

• CVE-2026-56224MEDIUM 5.4

  Capgo's web console at console.capgo.app/login versions before 12.128.2 has a design flaw that allows authentication tokens to be passed directly in web links. An attacker can send a victim a specially crafted link containing valid access and refresh tokens; when clicked, the victim is automatically logged into the attacker's account without any confirmation step. This exposes the tokens in the victim's browser history, cached logs, and server access logs, creating multiple avenues for token theft and account compromise.

• CVE-2026-59883MEDIUM 4.7

  Guzzle, a widely-used PHP HTTP client library, contains a cookie-handling flaw that can allow attackers to leak cookies between different hosts or inject cookies into requests. The vulnerability exists in how Guzzle's CookieJar component validates which domains a cookie belongs to. When a cookie is scoped to an IP address (like 192.168.0.1 or ::1) or a bare numeric value, Guzzle incorrectly applies standard domain suffix matching rules instead of requiring an exact match. This means a cookie set for one IP could be sent to a different IP on the same network, or a cookie meant for one host could be injected into requests to another. The issue affects Guzzle versions prior to 7.12.3 and requires user interaction to exploit (such as visiting a malicious page), but can impact any application using vulnerable Guzzle versions.

• CVE-2026-53900MEDIUM 4.3

  Firefox for iOS was inadvertently preserving cookies from initial PDF requests even when those requests were redirected across different websites. An attacker could craft a malicious site that, when visited by a user, exploits this behavior to inject cookies into legitimate requests sent to an unrelated target domain—potentially allowing credential theft or session hijacking without the user's knowledge. Apple users running Firefox for iOS below version 152.0 are affected. Mozilla has patched this in Firefox for iOS 152.0.

• CVE-2026-41839MEDIUM 4.2

  Spring Framework versions 5.3, 6.1, 6.2, and 7.0 contain a session management flaw in WebFlux applications. If an attacker first compromises a subdomain (through XSS or similar attack), they can trade a known session ID for one belonging to an authenticated user, potentially gaining unauthorized access to that user's account or data. The flaw requires two conditions: initial subdomain compromise and user interaction, which limits its immediate exploitability but remains a meaningful risk in multi-tenant or loosely-segmented environments.