What is the CVSS score of CVE-2025-69602?

CVE-2025-69602 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of 66biolinks are affected by CVE-2025-69602?

CVE-2025-69602 is a critical session fixation vulnerability in 66biolinks v62.0.0 that allows attackers to hijack authenticated user sessions without requiring a password.

Is there a public PoC exploit available for CVE-2025-69602?

Yes, a public proof-of-concept exploit is available for CVE-2025-69602. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-69602?

Within 24 hours: Identify all instances of 66biolinks v62.0.0 in your environment and restrict network access to trusted users only. Within 7 days: Evaluate alternative biolink management solutions or implement comprehensive WAF rules to block session fixation attack patterns. Within 30 days: Migrate to an alternative vendor solution or deploy enhanced session management controls with mandatory session regeneration at the application layer if in-house modification is possible.

66biolinks CVE-2025-69602

CRITICAL

Session Fixation (CWE-384)

2026-01-28 cve@mitre.org

Information Disclosure 66biolinks Altumcode

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 09, 2026 - 17:24 vuln.today

Public exploit code

CVE Published

Jan 28, 2026 - 19:16 nvd

CRITICAL 9.1

DescriptionCVE.org

A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier after successful authentication. As a result, the same session cookie value is reused for users logging in from the same browser, allowing an attacker who can set or predict a session ID to potentially hijack an authenticated session.

AnalysisAI

66biolinks v62.0.0 has a session fixation vulnerability where the application doesn't regenerate session IDs after authentication, enabling session hijacking.

Technical ContextAI

66biolinks v62.0.0 by AltumCode has a CWE-384 session fixation vulnerability where the session identifier is not regenerated after successful authentication, allowing an attacker who knows the pre-auth session ID to hijack the authenticated session.