What is the CVSS score of CVE-2025-69602?

CVE-2025-69602 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of 66biolinks are affected by CVE-2025-69602?

CVE-2025-69602 is a critical session fixation vulnerability in 66biolinks v62.0.0 that allows attackers to hijack authenticated user sessions without requiring a password.

Is there a public PoC exploit available for CVE-2025-69602?

Yes, a public proof-of-concept exploit is available for CVE-2025-69602. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-69602?

Within 24 hours: Identify all instances of 66biolinks v62.0.0 in your environment and restrict network access to trusted users only. Within 7 days: Evaluate alternative biolink management solutions or implement comprehensive WAF rules to block session fixation attack patterns. Within 30 days: Migrate to an alternative vendor solution or deploy enhanced session management controls with mandatory session regeneration at the application layer if in-house modification is possible.

66biolinks CVE-2025-69602

CRITICAL

Session Fixation (CWE-384)

2026-01-28 cve@mitre.org

Information Disclosure 66biolinks

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 09, 2026 - 17:24 vuln.today

Public exploit code

CVE Published

Jan 28, 2026 - 19:16 nvd

CRITICAL 9.1

DescriptionCVE.org

A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier after successful authentication. As a result, the same session cookie value is reused for users logging in from the same browser, allowing an attacker who can set or predict a session ID to potentially hijack an authenticated session.

AnalysisAI

66biolinks v62.0.0 has a session fixation vulnerability where the application doesn't regenerate session IDs after authentication, enabling session hijacking.

Technical ContextAI

66biolinks v62.0.0 by AltumCode has a CWE-384 session fixation vulnerability where the session identifier is not regenerated after successful authentication, allowing an attacker who knows the pre-auth session ID to hijack the authenticated session.

RemediationAI

Update the software. Ensure session IDs are regenerated after every authentication event.

CVE-2025-69602 vulnerability details – vuln.today

Back

66biolinks CVE-2025-69602

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code