Description
Dev blog v1.0 allows to exploit an account takeover through the "user" cookie. With this, an attacker can access any user's session just by knowing their username.
References (2)
Core 2
Core References
Exploit, Third Party Advisory
https://fluidattacks.com/advisories/almighty/
Scores
CVSS v3
9.1
EPSS
0.0007
EPSS Percentile
21.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Details
CWE
CWE-639
Status
published
Products (1)
armanidrisi/dev_blog
1.0
Published
Nov 21, 2023
Tracked Since
Feb 18, 2026