CVE-2025-69602
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3Description
A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier after successful authentication. As a result, the same session cookie value is reused for users logging in from the same browser, allowing an attacker who can set or predict a session ID to potentially hijack an authenticated session.
Analysis
66biolinks v62.0.0 has a session fixation vulnerability where the application doesn't regenerate session IDs after authentication, enabling session hijacking.
Technical Context
66biolinks v62.0.0 by AltumCode has a CWE-384 session fixation vulnerability where the session identifier is not regenerated after successful authentication, allowing an attacker who knows the pre-auth session ID to hijack the authenticated session.
Affected Products
['66biolinks v62.0.0 by AltumCode']
Remediation
Update the software. Ensure session IDs are regenerated after every authentication event.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today