EUVD-2026-81621
GHSA-jq63-mx4g-ww7g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker fetches valid PHPSESSID from site
-
DeliveryCraft link embedding session id
-
ExploitEmail link to target victim
-
ExecutionVictim opens link and authenticates
-
PersistAttacker replays fixated session id
-
ImpactHijack authenticated account access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V7 - Session Management Session fixation prevention
|
| Exploitation Conditions | Exploitable only against HUBzero CMS versions through 2.2.32 where the legacy Session Manager accepts a session id from the ?PHPSESSID query string (or a request/form variable) when no session cookie is present - a code path originally added for the retired Safari QuickTime plugin. Successful hijack REQUIRES active victim interaction: the victim must open the attacker-supplied link and then authenticate under the fixated identifier (UI:A). No attacker authentication is needed (PR:N), but the dependency on victim login and social-engineering delivery is the key limiting factor. Patched versions ignore query-string/form session ids entirely, using only the cookie. |
| Impact | This is a real, well-substantiated session fixation flaw (CWE-384) with strong corroboration: a vendor patch commit (e60e8eb) is publicly available and the exact vulnerable code is pinned to Manager.php:123-132, so the mechanism is confirmed rather than inferred. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N) indicates a network-reachable, low-complexity, unauthenticated attack that nonetheless requires active victim interaction (UI:A) - the victim must open the attacker's link AND authenticate for the hijack to succeed, which meaningfully caps mass-exploitation potential. No EPSS score, no CISA KEV listing, and no public exploit are provided, so exploitation status is: no public exploit identified at time of analysis. The vendor CVSS of 8.5 is arguably high for a fixation bug that depends on social engineering and victim login; the impact is genuine account takeover (justifying VC:H/VI:H) but the UI:A requirement and lack of exploitation telemetry make this a moderate practical priority rather than an emergency, especially given HUBzero's niche footprint. No signals directly conflict, but note the vendor 4.0 score is not independently reproduced here and there is no availability impact (VA:N), which is consistent with the fixation-only mechanism. |
| Exploit ScenarioDerived | An unauthenticated attacker visits the HUBzero site to obtain a valid PHPSESSID, then emails a victim a crafted link embedding that identifier in the query string (e.g. ?PHPSESSID=<32-char-id>). Because the pre-patch Manager.php accepts a session id from the query string when no cookie is present, the victim's browser adopts the attacker-chosen session; after the victim logs in, the attacker replays the same identifier to inherit the authenticated session. No public exploit is published, but the flaw is trivially reproducible from the patch diff. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Session fixation in HUBzero CMS through 2.2.32 lets unauthenticated remote attackers hijack authenticated accounts because the Session Manager accepts a session identifier from the ?PHPSESSID query string or a request/form variable whenever no session cookie is present; an attacker can obtain a valid id from the site, send the victim a crafted link containing it, and replay that id after the victim logs in. Exploitation is limited by user interaction - the victim must follow the attacker-supplied link and then authenticate under the fixated identifier (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N; vendor-published CVSS 4.0 base 8.5, VC:H/VI:H/VA:N). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, but the vulnerable code path is publicly confirmed and the upstream fix commit is available.
RemediationAI
Apply the upstream fix commit e60e8ebee5e1d38b1db1fc41bd9164b265b24356 (https://github.com/hubzero/hubzero-cms/commit/e60e8ebee5e1d38b1db1fc41bd9164b265b24356), which removes the query-string/form session id paths in core/libraries/Hubzero/Session/Manager.php so that only the session cookie may name an existing session; a vendor advisory is published as patch data and via VulnCheck at https://www.vulncheck.com/advisories/hubzero-cms-through-2.2.32-session-fixation-via-query-string-session-identifier. Note that the available intelligence points to a GitHub commit rather than a tagged release, so the exact first patched released version is not independently confirmed - deploy the commit or a release that contains it, and verify that the ?PHPSESSID branch and the \Request::getVar($session_name) branch are both gone before considering a site fixed. If patching is not immediately possible, the most effective compensating control is to have PHP regenerate the session identifier on successful authentication (session_regenerate_id / equivalent in the site's login flow), which invalidates any pre-set id at the moment it would matter; the trade-off is that this only defeats fixation at login and leaves other cookie-less session reuse behaviour in place. A second option is to strip or reject any inbound request that carries PHPSESSID in the query string or body at the reverse proxy or WAF (URL-rewrite rule plus a body-inspection rule), trading away the one legitimately affected use case - cookie-less clients such as the retired QuickTime plugin - while adding a config surface that must be kept consistent with any future legitimate token mechanism. The patch's own guidance is to give cookie-less clients a dedicated token rather than reusing the session id; do not reinstate the removed code path. No public exploit code was identified at time of analysis, but because exploitation only needs a crafted link and a victim login, prioritise patching internet-facing HUBzero deployments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-384 (Session Fixation) in PHP session handling inside core/libraries/Hubzero/Session/Manager.php. In versions through 2.2.32, the manager's constructor would, when $_COOKIE[session_name()] was absent, read $_GET['PHPSESSID'], accept it if it was a 32-character alphanumeric string, and - if the session store returned a non-empty value for that id - call session_id() with the attacker-supplied value. The store check was circular: it only proved the id existed, which is precisely what the attacker arranged by first visiting the site. A second vulnerable path in start() read the session name via \Request::getVar($session_name), which also pulls from POST/form and request variables, called session_id($id), and then deleted the cookie. The behaviour originated as a workaround for the retired Safari QuickTime plugin, which did not forward browser cookies when fetching private mp4 files; the code comment removed by the fix explicitly states the plugin is long gone. The CPE cpe:2.3:a:hubzero:hubzero-cms:*:*:*:*:*:*:*:* covers all HUBzero CMS releases up to and including 2.2.32, and the vulnerable lines are pinned to Manager.php:123-132 at tag v2.2.32. The committed fix removes both paths so that only the cookie may name an existing session, and a request without the cookie starts a session with a server-generated id.
Know when Hubzero Cms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network, low-complexity, unauthenticated fixation, but victim must click the link and authenticate (UI:R); successful hijack yields full account confidentiality and integrity, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted link containing it, and replay the identifier after the victim authenticates to hijack their account and access.
Executive ViewAI
HUBzero CMS, a platform commonly used for scientific research portals and community collaboration sites, contains a session fixation flaw in all versions through 2.2.32 that allows an attacker to take over a legitimate user's account after that user clicks a crafted link and logs in. Because affected accounts may include researchers, administrators, and partners with access to sensitive collaboration data, successful exploitation could result in unauthorized access to proprietary research, defacement, or lateral movement within the portal. Leadership should prioritize remediation given the high confidentiality and integrity impact, while noting that exploitation requires the victim to follow an attacker-supplied link and then authenticate.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB