EUVD-2026-81412Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Network-reachable SSO endpoint with no prior auth (PR:N) but a timing race (AC:H) and reliance on a concurrent victim login (UI:R); cross-user session takeover crosses the auth boundary (S:C) giving C:H/I:H, no availability impact.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
Lifecycle Timeline
4DescriptionCVE.org
For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently
AnalysisAI
Concurrent SAML or OpenID Connect login attempts against SUSE NeuVector can cause one user to be issued another user's fully authenticated session, effectively handing an attacker the victim's account and the RBAC privileges attached to it. The flaw affects NeuVector deployments configured for external SSO (local/built-in authentication is not implicated), requires no prior authentication (PR:N) but is timing-dependent and needs the attacker's login flow to overlap an active victim login (CVSS 8.0, AV:N/AC:H/UI:R/S:C). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires NeuVector to be configured for external SSO - specifically users authenticating via SAML or OpenID Connect (OIDC); local/built-in authentication is not implicated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 8.0 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) captures a serious authentication/session-integrity flaw: under concurrent SAML/OIDC login attempts, NeuVector can hand one user another user's fully authenticated session, yielding account takeover (C:H/I:H) with a scope change (S:C) across the authentication trust boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version was identified in the available data, so the first step is to check the upstream advisory at https://github.com/neuvector/neuvector/security/advisories/GHSA-c6rx-pmvf-m3jx and the SUSE tracking bug at https://bugzilla.suse.com/show_bug.cgi?id=1279937 for the current fixed release and upgrade schedule before planning any change. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether any NeuVector deployment in your environment is configured for external SAML or OpenID Connect authentication, and if so, restrict network access to the NeuVector management UI and API to trusted administrative networks or VPNs only; enable and forward detailed authentication and session logs to your SIEM for monitoring of concurrent or anomalous login patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Session Fixation
View allSession fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID pa
Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session
Tiny File Manager v2.4.7 and below is vulnerable to session fixation. Rated critical severity (CVSS 9.8), this vulnerabi
A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /login
Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. Rated criti
An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to exe
A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to ex
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7. Rated critical severity (CVSS 9.8), this vulnerab
Certain NetModule devices allow Limited Session Fixation via PHPSESSID. Rated critical severity (CVSS 9.8), this vulnera
An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Rated critical severity (CVSS 9.8), this v
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests be
Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." s
Same weakness CWE-384 – Session Fixation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today