EUVD-2026-83252Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
AC:H for the cookie-fixation-plus-victim-auth chain; PR:N because the anonymous share-page cookie needs no privileges; UI:R as the victim must enter the note password; C:L/I:L limited to one shared note, A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor session cookie, place it in a victim's browser, and know the shared-note URL where the victim authenticates can reuse the fixed session after the victim enters the correct password and access that shared note. The main SysReptor login flow is not affected. This issue is fixed in version 2026.68.
AnalysisAI
Session fixation in the password-protected shared-notes flow of SysReptor (Syslifters) before version 2026.68 lets an attacker who can plant a known, unauthenticated share-page session cookie in a victim's browser reuse that session after the victim enters the correct note password, gaining access to that shared note. The main SysReptor login is unaffected; only the 'publicshareinfo-auth' / 'sharednote-detail' share flow fails to rotate the session identifier on successful authentication (CWE-384). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation is limited to the password-protected shared-notes feature of SysReptor (the 'publicshareinfo-auth' / 'sharednote-detail' flow); the main SysReptor login is not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue despite being network-reachable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade SysReptor to version 2026.68 or later (per the advisory GHSA-wgx3-84xg-q93j and release tag https://github.com/Syslifters/sysreptor/releases/tag/2026.68), which applies the upstream fix commit 1981717f15afe945aa86d7e0dc9dc30a30c88dea adding request.session.cycle_key() to the shared-note password authentication view; this is the only complete remediation and has no functional side effects since Django session cycling is transparent to legitimate users. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Session Fixation
View allSession fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID pa
Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session
Tiny File Manager v2.4.7 and below is vulnerable to session fixation. Rated critical severity (CVSS 9.8), this vulnerabi
A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /login
Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. Rated criti
An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to exe
A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to ex
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7. Rated critical severity (CVSS 9.8), this vulnerab
Certain NetModule devices allow Limited Session Fixation via PHPSESSID. Rated critical severity (CVSS 9.8), this vulnera
An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Rated critical severity (CVSS 9.8), this v
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests be
Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." s
Same weakness CWE-384 – Session Fixation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today