What is the CVSS score of CVE-2026-23796?

CVE-2026-23796 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Quick.Cart are affected by CVE-2026-23796?

CVE-2026-23796 is a critical session fixation vulnerability in Quick.Cart that allows attackers to hijack user accounts and gain unauthorized access to customer data and transactions without…

How to fix or mitigate CVE-2026-23796?

Within 24 hours: Identify all Quick.Cart instances in production and document exposure scope; notify affected customers of potential risk; enable enhanced logging on authentication and session management. Within 7 days: Implement compensating controls (session regeneration enforcement, IP-based session validation); consider disabling Quick.Cart until mitigation is confirmed effective. Within 30 days: Contact vendor for patch timeline; evaluate alternative solutions if patch is not forthcoming; conduct security audit of all Quick.Cart user accounts for unauthorized access indicators.

Quick.Cart CVE-2026-23796

CRITICAL

Session Fixation (CWE-384)

2026-02-05 cvd@cert.pl

Information Disclosure Quick.Cart Quick Cart Opensolution

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 05, 2026 - 12:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Quick.Cart allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.7 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

AnalysisAI

Session fixation vulnerability in Quick.Cart allows attackers to set a user's session identifier before authentication. The session ID persists through login, enabling session hijacking of authenticated users.

Technical ContextAI

CWE-384 session fixation. Quick.Cart fails to regenerate the session ID upon successful authentication, allowing a pre-set session identifier to remain valid after login.