EUVD-2026-71442
GHSA-79fq-cfh4-h8hv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain/set fixed HUBCOREID cookie value
-
DeliveryDeliver fixed session to victim
-
ExploitVictim authenticates under attacker's session ID
-
ExecutionSession not regenerated on login
-
PersistReuse HUBCOREID to hijack account
-
ImpactEscalate to victim's privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V7 - Session Management Session fixation prevention
|
| Exploitation Conditions | Exploitation targets HubCore v14.1.1's HUBCOREID session cookie handling and, as a session fixation (CWE-384) flaw, characteristically requires: (1) the attacker to obtain or set a specific HUBCOREID value, and (2) the victim to subsequently authenticate while that fixed session identifier is in effect, because the application fails to regenerate the session ID on login/privilege transition. The practical limiting factor is that a victim authentication event is typically needed (user interaction), even though the input CVSS marks UI:N; no special non-default configuration is documented, but the exact preconditions are unconfirmed absent a vendor advisory. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8 Critical) portrays this as a trivially exploitable, fully unauthenticated network attack with total impact - but this conflicts with the vulnerability class. CWE-384 (Session Fixation), reinforced by the 'Session Fixation' tag, characteristically requires a victim to authenticate against an attacker-supplied session identifier, which implies user interaction (UI:R) not reflected in the input vector; the A:H (availability) rating is also poorly justified for a session-handling/account-takeover bug. The corroborating signals argue against emergency priority: EPSS is only 0.22% (13th percentile), there is no CISA KEV listing (not actively exploited), and while a third-party GitHub research repository (SilviaMun) indicates publicly available exploit code likely exists, POC availability is not active exploitation. Net: treat as a genuine account-takeover/privilege-escalation flaw worth patching, but the 9.8 rating overstates real-world risk - the true severity is closer to High, and the AV:N/AC:L/PR:N/UI:N/A:H combination should be verified against the actual attack mechanism with the vendor. |
| Exploit ScenarioDerived | An attacker plants or fixes a known HUBCOREID session cookie value in a victim's browser (e.g., via a crafted link or shared/unrotated session), then waits for the victim to authenticate to HubCore; because the session identifier is not regenerated on privilege change or login, the attacker reuses the same HUBCOREID to inherit the victim's authenticated, higher-privileged session. Publicly available exploit/research code appears to exist in a third-party GitHub repository, lowering the bar to reproduce the issue. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Session fixation in HubCore v14.1.1's HUBCOREID cookie handling lets a remote attacker who can plant or obtain a known session identifier take over a victim's authenticated session, escalating to that user's privileges once the victim logs in. Per the authoritative assessment, exploitation characteristically requires user interaction (the victim must authenticate while the attacker-fixed HUBCOREID is in effect), even though the input CVSS 3.1 vector claims UI:N and a 9.8 base score - that vector overstates the practical attack, which is not a one-shot unauthenticated remote compromise. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, and EPSS is low at 0.22% (13th percentile), indicating limited observed exploitation activity; a third-party vulnerability-research writeup is referenced on GitHub, but it is not evidence of active exploitation.
RemediationAI
No vendor-released patch identified at time of analysis: there is no fix version in the supplied data, no vendor advisory in the references (only the product site https://hubcore.ai/), and the third-party research writeup at https://github.com/SilviaMun/vulnerability-research/tree/main/CVE-2026-75171 plus the NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-75171) and VulDB (https://vuldb.com/vuln/398988) entries should be monitored for an update. Until the vendor ships a fix, apply compensating controls that directly target the session-fixation mechanism: force regeneration of the HUBCOREID identifier on every authentication and privilege transition and invalidate all pre-authentication session identifiers, accepting that this will terminate any in-progress anonymous sessions; set the session cookie with the __Host- prefix, Secure, HttpOnly, and SameSite=Lax or Strict so it cannot be planted or read cross-site, with the trade-off that cross-site embedded workflows may break; reject requests whose HUBCOREID was not issued in the current exchange and expire idle/anonymous sessions aggressively, which can increase benign re-authentication prompts; and restrict or monitor access to HubCore 14.1.1 management endpoints with session-cookie reuse detection (same identifier seen from differing source addresses or user agents), acknowledging that IP-binding is noisy for mobile and NATed users. If HubCore 14.1.1 cannot be protected, isolating it behind an authenticating reverse proxy that issues its own session tokens and rate-limit or block anomalous HUBCOREID submission patterns are the remaining options, at the cost of added integration complexity.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-384 (Session Fixation): the HUBCOREID session cookie is not rotated when a session transitions from anonymous to authenticated or when privilege levels change, so a session identifier that is known to an attacker remains valid after the victim authenticates. The classic attack flow is that the attacker establishes or forces a specific HUBCOREID value into the victim's browser (for example via a crafted link, cross-site request, or other session-planting vector), the victim then authenticates against HubCore v14.1.1, and the application reuses the pre-authentication identifier rather than issuing a new one, leaving the attacker holding a valid handle to the now-privileged session. Because the flaw lives in session lifecycle management rather than in cryptographic or memory-safety code, the practical severity depends on how the identifier can be delivered to the victim and whether the deployment's cookie attributes (Secure, HttpOnly, SameSite, __Host- prefix) block the planting step. The provided CPE string is unresolved (cpe:2.3:a:n/a:n/a) and EUVD lists the affected version as 'n/a n/a', so vendor/product normalization is absent from the feed data; all version-specific statements in this analysis rest on the description's identification of HubCore v14.1.1.
Know when Session Fixation gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Session fixation needs a victim to authenticate under the attacker's session (UI:R); result is account/privilege takeover giving C:H/I:H, but no direct availability impact so A:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component.
Executive ViewAI
HubCore v14.1.1 contains a session fixation flaw in HUBCOREID cookie handling that could allow an attacker to take over a victim’s authenticated HubCore session and operate with that user’s privileges. Organizations running this version are affected, and because no vendor patch is available, leadership should prioritize interim controls and monitoring while treating the issue as a high-impact access-control risk. Exploitation requires the victim to authenticate while a known attacker-fixed session identifier is in effect; no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis; implement session ID regeneration on login, strict HUBCOREID cookie flags (Secure, HttpOnly, SameSite), short session timeouts, MFA, session binding to client attributes where supported, least-privilege review, WAF/virtual patching for cookie manipulation, monitoring for anomalous session reuse, and network restrictions on HubCore management interfaces.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Session Fixation
View allSession hijacking in self-hosted Zammad 6.3.0 through 6.5.4 allows remote, unauthenticated attackers to take over a legi
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID pa
Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session
Tiny File Manager v2.4.7 and below is vulnerable to session fixation. Rated critical severity (CVSS 9.8), this vulnerabi
A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /login
Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. Rated criti
An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to exe
A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to ex
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7. Rated critical severity (CVSS 9.8), this vulnerab
Certain NetModule devices allow Limited Session Fixation via PHPSESSID. Rated critical severity (CVSS 9.8), this vulnera
An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Rated critical severity (CVSS 9.8), this v
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests be
Exploit-DB