CWE-384

Session Fixation

Parent: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

392 vulnerabilities with CWE-384
CVE-2026-34454 LOW
OAuth2 Proxy: Session cookie not cleared when rendering sign-in page
CVSS 3.5
CVE-2026-31940 HIGH
Session Fixation in Chamilo LMS
CVSS 7.5
CVE-2026-33946 MEDIUM
MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
CVSS 5.9
CVE-2026-33757 CRITICAL
OpenBao lacks user confirmation for OIDC direct callback mode
CVSS 9.6
CVE-2026-25101 CRITICAL
Session Fixation in Bludit
CVSS 9.8
CVE-2026-33492 HIGH
AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration
CVSS 7.3
CVE-2026-30224 MEDIUM
OliveTin <3000.11.1 - Auth Bypass
CVSS 5.4
CVE-2026-24352 CRITICAL
PluXml CMS 5.8.21/5.9.0-rc7 - Session Fixation
CVSS 9.8
CVE-2026-24894 HIGH
FrankenPHP <1.11.2 - Info Disclosure
CVSS 7.5
CVE-2026-2177 HIGH
SourceCodester Prison Management System 1.0 - Session Fixation
CVSS 7.3
CVE-2026-23796 CRITICAL
Quick.Cart <6.7 - Session Hijacking
CVSS 9.8
CVE-2026-23624 MEDIUM
GLPI <10.0.23-11.0.5 - Info Disclosure
CVSS 4.3
CVE-2026-22082 HIGH
Tenda Wireless Router - Auth Bypass
CVE-2025-46605 MEDIUM
Dell PowerProtect Data Domain 8.4-8.5 - Session Fixation
CVSS 6.2
CVE-2025-55266 MEDIUM
HCL Aftermarket DPC is affected by Session Fixation
CVSS 5.9
CVE-2025-70973 MEDIUM
ScadaBR 1.12.4 - Session Fixation
CVSS 4.8
CVE-2025-71057 HIGH
D-Link DSL-124 ME_1.00 - Session Hijacking
CVSS 8.2
CVE-2025-7014 MEDIUM
QR Menu Pro Smart Menu Systems Menu Panel <29012026 - Session Fixation
CVSS 5.7
CVE-2025-7015 MEDIUM
QR Menu <s1.05.12 - Session Fixation
CVSS 5.7
CVE-2025-69602 CRITICAL
AltumCode 66biolinks v62.0.0 - Session Fixation
CVSS 9.1
CVE-2025-68139 MEDIUM
EVerest <2025.12.1 - Info Disclosure
CVSS 4.3
CVE-2025-36115 MEDIUM
IBM Sterling Connect:Express Adapter - Privilege Escalation
CVSS 6.3
CVE-2025-43516 LOW
macOS <26.2-15.7.3-14.8.3 - Info Disclosure
CVSS 3.3
CVE-2025-63529 MEDIUM
Blood Bank Management System 1.0 - Session Fixation
CVSS 6.1
CVE-2025-65681 LOW
Overhang.IO <20.0.2 - Info Disclosure
CVSS 3.3
Details
Vulnerabilities 392
Links
MITRE CWE Entry Search this CWE With Exploits