CVE-2026-25101
Received Received - Intake
Session Fixation Vulnerability in Bludit Allows Session Hijacking

Publication date: 2026-03-27

Last updated on: 2026-04-02

Assigner: CERT.PL

Description
Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enables an attacker to fix a session ID for a victim and later hijack the authenticated session. This issue was fixed in version 3.17.2.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-27
Last Modified
2026-04-02
Generated
2026-06-16
AI Q&A
2026-03-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-25101
EUVD
EUVD-2026-16581
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
bludit bludit to 3.17.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-384 Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Bludit allows an attacker to set a user's session identifier before the user authenticates. Because the session ID remains the same after authentication, the attacker can fix a session ID for a victim and later hijack the authenticated session.

Impact Analysis

The vulnerability enables an attacker to hijack an authenticated session by fixing the session ID before the victim logs in. This can lead to unauthorized access to the victim's account and potentially sensitive information or actions performed under that account.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Bludit to version 3.17.2 or later, where the issue has been fixed.

Compliance Impact

This vulnerability allows an attacker to fix a session ID for a victim and later hijack the authenticated session. Such session hijacking can lead to unauthorized access to user data.

Unauthorized access to user data can potentially violate data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

Therefore, this vulnerability may negatively impact compliance with these standards by exposing user sessions to hijacking risks.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25101. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart