EUVD-2026-70118
GHSA-42rh-v5qm-8p5w
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
AC raised to H because attacker must control same-origin content delivery and synchronize with victim's remember-me authentication event; all other metrics match confirmed attack behavior.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
5DescriptionCVE.org
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacker access to Jenkins as that user.
AnalysisAI
Session fixation in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows an attacker who can serve content on the same site as Jenkins to inject a known session cookie into a victim's browser; when the victim subsequently authenticates via the persistent 'remember me' cookie without session rotation, the attacker inherits the fully authenticated session. The attack chain requires low-privilege same-site content delivery access and active victim participation in a remember-me login flow, meaningfully constraining real-world exploitability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the attacker must have the capability to serve arbitrary content on the same site/origin as the Jenkins instance - achievable via a low-privilege Jenkins account with job creation or workspace file-serving access, or any other same-origin content delivery mechanism - to plant a predictable session identifier in the victim's browser; and (2) the victim must be using the 'remember me' persistent authentication cookie and must trigger a new session via that mechanism (i.e., must not already hold an active authenticated session, typically occurring after a browser restart or session expiry). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 7.3 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) correctly captures full confidentiality and integrity impact after session hijack, but AC:L understates the operational prerequisites - the attacker must control a same-origin content delivery path and synchronize with the victim's remember-me authentication event, a multi-step dependency that in practice raises attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Jenkins to version 2.580 (weekly) or 2.568.3 (LTS) as documented in the Jenkins Security Advisory at https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-4016; these are the vendor-confirmed patched versions per EUVD. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Jenkins instances running versions 2.579 or earlier (LTS 2.568.2 or earlier) and document remember-me feature usage across your deployment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Session Fixation
View allSession fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID pa
Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session
Tiny File Manager v2.4.7 and below is vulnerable to session fixation. Rated critical severity (CVSS 9.8), this vulnerabi
A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /login
Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. Rated criti
An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to exe
A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to ex
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7. Rated critical severity (CVSS 9.8), this vulnerab
Certain NetModule devices allow Limited Session Fixation via PHPSESSID. Rated critical severity (CVSS 9.8), this vulnera
An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Rated critical severity (CVSS 9.8), this v
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests be
Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." s
Same weakness CWE-384 – Session Fixation
View allShare
External POC / Exploit Code
Leaving vuln.today