Monthly
Privilege escalation via session fixation in IBM Administration Runtime Expert (ARE) for i, version 1R1M0, lets a remote attacker cause actions to run under another user's authenticated profile through flawed handling in the ARE GUI component, yielding elevated privileges on the IBM i host. The description characterizes the attacker as unauthenticated, though the CVSS 3.1 vector (PR:L) implies some low-privilege foothold - this signal conflict should be confirmed with IBM. No public exploit identified at time of analysis, and it is not on CISA KEV; EPSS was not provided.
Session fixation in Ghost Admin (v2.2.0-v6.54.0) allows an attacker who can plant a known session identifier in a victim's browser - via a secondary vulnerability on the same domain - to hijack an authenticated Ghost Admin session after the victim logs in. The root cause is that Ghost Admin's login flow did not call session regeneration, leaving the pre-login session ID valid post-authentication. Exploitation is chained and non-trivial, but the upstream fix (v6.54.1) is confirmed and straightforward to apply. No public exploit code and no CISA KEV listing identified at time of analysis.
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains another user's MCP session identifier execute their own tool calls under the victim's Terraform credentials when the server runs in streamable-HTTP stateful transport mode. Rooted in a session fixation weakness (CWE-384), the flaw carries a CVSS 8.9 with a scope change, meaning cross-user credential misuse against managed infrastructure. No public exploit identified at time of analysis; EPSS is low (0.27%) and CISA SSVC records exploitation as none, indicating no observed active exploitation.
Authorization code injection in Red Hat Build of Keycloak's keycloak-services component enables a network-positioned attacker to hijack OAuth 2.0 flows by intercepting and cross-client redeeming authorization codes. Because codes are not cryptographically bound to the originating client, an attacker who obtains a victim's in-flight code can submit it using their own registered client credentials and receive access tokens tied to the victim's identity. No public exploit has been identified at time of analysis, and the CVSS AC:H rating reflects the non-trivial code interception prerequisite that constrains opportunistic exploitation.
Session fixation in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 enables remote attackers to pre-set a known session identifier in a victim's browser, then hijack the authenticated session after the victim logs in. The CVSS 4.0 score of 2.9 reflects limited impact scope (low confidentiality, integrity, and availability) combined with high attack complexity, though a public exploit has been released (E:P). No CISA KEV listing indicates no confirmed widespread active exploitation at time of analysis.
Session fixation in the Wikimedia Foundation OAuth MediaWiki extension (src/Backend/MWOAuthServer.php) allows a network-accessible, low-privileged attacker to manipulate the OAuth authorization handshake so that a victim's authentication binds to an attacker-controlled session identifier. All four actively maintained release branches are affected through versions 1.46.0, 1.45.4, 1.44.6, and 1.43.9. No public exploit or CISA KEV listing exists at time of analysis; however, the 'Information Disclosure' tag applied to this CVE creates tension with the vendor-supplied CVSS 4.0 zero-impact scoring and warrants independent verification.
Session fixation in the Capgo cloud console login endpoint (console.capgo.app/login) allows unauthenticated remote attackers to force victims into attacker-controlled sessions by crafting malicious URLs containing attacker-owned tokens. Versions before 12.128.2 silently accept access_token and refresh_token as URL query parameters and authenticate the user without confirmation, bypassing normal login flows. Tokens passed via URL are additionally exposed in browser history, server access logs, and HTTP Referer headers, creating secondary information-disclosure risk. No public exploit code and no CISA KEV listing exist at time of analysis.
Session fixation in KTM System e-BOK (an online customer service portal) enables an attacker to preset a session identifier in a victim's browser before authentication, which the application then retains unchanged after successful login. Because the server accepts a client-supplied cookie value and never regenerates it at the authentication boundary, an attacker who controls the initial session token can hijack the victim's fully authenticated session. A patch was published by KTM System in June 2026; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Multiple OAuth 2.0 flow weaknesses in the MISP AAD (Azure Active Directory) authentication plugin allow session hijacking, session fixation, CSRF/replay against the OAuth callback, plaintext credential exposure over non-HTTPS redirect URIs, and log injection. The plugin reused the PHP session_id() as the OAuth state parameter, never rotated the session ID after login, did not enforce HTTPS on the redirect URI, and logged attacker-controlled GET parameters verbatim. No public exploit identified at time of analysis, but an upstream fix is available in MISP commit 146bc40.
Session fixation in Digiwin EasyFlow .NET allows unauthenticated remote attackers to pre-set a victim's session identifier and hijack the authenticated session once the victim logs in, inheriting the victim's privileges. No public exploit identified at time of analysis, but the CVSS 4.0 score of 7.7 and HIGH impact across confidentiality, integrity, and availability mark this as a meaningful risk for organizations using the workflow platform. The flaw is tracked under CWE-384 and was disclosed via TWCERT, with no specific patched version cited in the provided references.
Privilege escalation via session fixation in IBM Administration Runtime Expert (ARE) for i, version 1R1M0, lets a remote attacker cause actions to run under another user's authenticated profile through flawed handling in the ARE GUI component, yielding elevated privileges on the IBM i host. The description characterizes the attacker as unauthenticated, though the CVSS 3.1 vector (PR:L) implies some low-privilege foothold - this signal conflict should be confirmed with IBM. No public exploit identified at time of analysis, and it is not on CISA KEV; EPSS was not provided.
Session fixation in Ghost Admin (v2.2.0-v6.54.0) allows an attacker who can plant a known session identifier in a victim's browser - via a secondary vulnerability on the same domain - to hijack an authenticated Ghost Admin session after the victim logs in. The root cause is that Ghost Admin's login flow did not call session regeneration, leaving the pre-login session ID valid post-authentication. Exploitation is chained and non-trivial, but the upstream fix (v6.54.1) is confirmed and straightforward to apply. No public exploit code and no CISA KEV listing identified at time of analysis.
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains another user's MCP session identifier execute their own tool calls under the victim's Terraform credentials when the server runs in streamable-HTTP stateful transport mode. Rooted in a session fixation weakness (CWE-384), the flaw carries a CVSS 8.9 with a scope change, meaning cross-user credential misuse against managed infrastructure. No public exploit identified at time of analysis; EPSS is low (0.27%) and CISA SSVC records exploitation as none, indicating no observed active exploitation.
Authorization code injection in Red Hat Build of Keycloak's keycloak-services component enables a network-positioned attacker to hijack OAuth 2.0 flows by intercepting and cross-client redeeming authorization codes. Because codes are not cryptographically bound to the originating client, an attacker who obtains a victim's in-flight code can submit it using their own registered client credentials and receive access tokens tied to the victim's identity. No public exploit has been identified at time of analysis, and the CVSS AC:H rating reflects the non-trivial code interception prerequisite that constrains opportunistic exploitation.
Session fixation in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 enables remote attackers to pre-set a known session identifier in a victim's browser, then hijack the authenticated session after the victim logs in. The CVSS 4.0 score of 2.9 reflects limited impact scope (low confidentiality, integrity, and availability) combined with high attack complexity, though a public exploit has been released (E:P). No CISA KEV listing indicates no confirmed widespread active exploitation at time of analysis.
Session fixation in the Wikimedia Foundation OAuth MediaWiki extension (src/Backend/MWOAuthServer.php) allows a network-accessible, low-privileged attacker to manipulate the OAuth authorization handshake so that a victim's authentication binds to an attacker-controlled session identifier. All four actively maintained release branches are affected through versions 1.46.0, 1.45.4, 1.44.6, and 1.43.9. No public exploit or CISA KEV listing exists at time of analysis; however, the 'Information Disclosure' tag applied to this CVE creates tension with the vendor-supplied CVSS 4.0 zero-impact scoring and warrants independent verification.
Session fixation in the Capgo cloud console login endpoint (console.capgo.app/login) allows unauthenticated remote attackers to force victims into attacker-controlled sessions by crafting malicious URLs containing attacker-owned tokens. Versions before 12.128.2 silently accept access_token and refresh_token as URL query parameters and authenticate the user without confirmation, bypassing normal login flows. Tokens passed via URL are additionally exposed in browser history, server access logs, and HTTP Referer headers, creating secondary information-disclosure risk. No public exploit code and no CISA KEV listing exist at time of analysis.
Session fixation in KTM System e-BOK (an online customer service portal) enables an attacker to preset a session identifier in a victim's browser before authentication, which the application then retains unchanged after successful login. Because the server accepts a client-supplied cookie value and never regenerates it at the authentication boundary, an attacker who controls the initial session token can hijack the victim's fully authenticated session. A patch was published by KTM System in June 2026; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Multiple OAuth 2.0 flow weaknesses in the MISP AAD (Azure Active Directory) authentication plugin allow session hijacking, session fixation, CSRF/replay against the OAuth callback, plaintext credential exposure over non-HTTPS redirect URIs, and log injection. The plugin reused the PHP session_id() as the OAuth state parameter, never rotated the session ID after login, did not enforce HTTPS on the redirect URI, and logged attacker-controlled GET parameters verbatim. No public exploit identified at time of analysis, but an upstream fix is available in MISP commit 146bc40.
Session fixation in Digiwin EasyFlow .NET allows unauthenticated remote attackers to pre-set a victim's session identifier and hijack the authenticated session once the victim logs in, inheriting the victim's privileges. No public exploit identified at time of analysis, but the CVSS 4.0 score of 7.7 and HIGH impact across confidentiality, integrity, and availability mark this as a meaningful risk for organizations using the workflow platform. The flaw is tracked under CWE-384 and was disclosed via TWCERT, with no specific patched version cited in the provided references.