Which versions of Session Fixation are affected by EUVD-2026-16581?

Organizations using Bludit should be aware of moderate risk from CVE-2026-25101 rated CVSS 4.8. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2026-16581?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Session Fixation EUVD-2026-16581

Q: What is the CVSS score of EUVD-2026-16581?

EUVD-2026-16581 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-25101 MEDIUM

Session Fixation (CWE-384)

2026-03-27 CERT-PL

GHSA-fjj5-fj78-h28j

Information Disclosure Session Fixation

4.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

3.17.2

EUVD ID Assigned

Mar 27, 2026 - 12:15 euvd

EUVD-2026-16581

Analysis Generated

Mar 27, 2026 - 12:15 vuln.today

CVE Published

Mar 27, 2026 - 11:55 nvd

MEDIUM 4.8

DescriptionCVE.org

Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enables an attacker to fix a session ID for a victim and later hijack the authenticated session.

This issue was fixed in version 3.17.2.

AnalysisAI

Bludit versions prior to 3.17.2 allow attackers to fix a victim's session identifier before authentication, with the session ID persisting unchanged after successful login, enabling authenticated session hijacking via session fixation. The vulnerability affects all Bludit instances below version 3.17.2 and requires local access and user interaction to exploit. No public exploit code or active exploitation has been identified at the time of analysis, though the session fixation mechanism poses a moderate risk in multi-user or shared-access environments.

Technical ContextAI

Session fixation vulnerabilities (CWE-384) occur when an application fails to regenerate or invalidate session identifiers upon authentication state changes. In Bludit's case, the session management implementation permits an attacker to predetermine a session ID value before the user authenticates, and critically, this identifier is not regenerated post-authentication. The affected product is identified via CPE cpe:2.3:a:bludit:bludit:*:*:*:*:*:*:*:* with all versions prior to 3.17.2 in scope. This is a classic session handling flaw where the application trusts a client-supplied or pre-set session identifier rather than generating a fresh one after credential validation, allowing an attacker who can influence the session ID (via network access, shared hosting, or other vectors) to maintain control over an authenticated session without possessing valid credentials.

RemediationAI

Upgrade Bludit to version 3.17.2 or later immediately (see vendor release notes at https://github.com/bludit/bludit/releases/tag/3.17.2). Until patching is feasible, implement session security controls: configure the application to enforce secure session cookie flags (HttpOnly, Secure, SameSite=Strict if using cookies), enforce HTTPS-only connections to prevent session ID interception, and consider implementing IP-based session binding or device fingerprinting to detect anomalous session reuse. For shared hosting or multi-tenant environments, isolate Bludit instances and restrict session cookie scope to prevent cross-instance session fixation. Additionally, educate users to clear browser cookies and restart sessions when accessing sensitive administrative functions.