CVE-2026-55682

Deferred Deferred - Pending Action

Session Hijacking via PHPSESSID in WeGIA Web Manager

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute, and the vulnerable session handler affects all PHP pages. This issue is fixed in version 3.8.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55682

EUVD

EUVD-2026-101624

Affected Vendors & Products

Vendor	Product	Version / Range
LabRedesCefetRJ	WeGIA	< 3.8.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-384	Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in WeGIA before version 3.8.6 involves session fixation and information exposure. The application improperly handles PHPSESSID cookies by reflecting attacker-supplied values in Set-Cookie responses and using DB_HOST as the cookie domain. This allows attackers to set a session ID before a victim authenticates, then hijack the session after login. Additionally, the DB_HOST value is exposed in the cookie Domain attribute, leaking internal infrastructure details.

Detection Guidance

Check for improper PHPSESSID cookie handling in HTTP responses. Use tools like curl to inspect Set-Cookie headers for DB_HOST exposure. Example: curl -I http://target.com. Monitor for session fixation attempts by testing if session IDs can be set before authentication.

Impact Analysis

An attacker could hijack authenticated sessions by setting a session ID before a user logs in. This could lead to unauthorized access to sensitive data or functions within the application. The exposure of DB_HOST may also help attackers identify internal systems for further exploitation.

Compliance Impact

This vulnerability could violate GDPR's data protection requirements by enabling unauthorized access to personal data through session hijacking. For HIPAA, it may compromise protected health information confidentiality. Both regulations require safeguards against unauthorized access and data breaches.

Mitigation Strategies

Upgrade WeGIA to version 3.8.6 or later. Remove vulnerable code in web/html/seguranca/sessionStart.php. Use PHP's built-in session management with secure cookie settings like session_set_cookie_params(). Validate and sanitize all cookie inputs.

Hi! I’m here to help you understand CVE-2026-55682. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70