CVE-2026-25101
Session Fixation Vulnerability in Bludit Allows Session Hijacking
Publication date: 2026-03-27
Last updated on: 2026-04-02
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bludit | bludit | to 3.17.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-384 | Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Bludit allows an attacker to set a user's session identifier before the user authenticates. Because the session ID remains the same after authentication, the attacker can fix a session ID for a victim and later hijack the authenticated session.
How can this vulnerability impact me? :
The vulnerability enables an attacker to hijack an authenticated session by fixing the session ID before the victim logs in. This can lead to unauthorized access to the victim's account and potentially sensitive information or actions performed under that account.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Bludit to version 3.17.2 or later, where the issue has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an attacker to fix a session ID for a victim and later hijack the authenticated session. Such session hijacking can lead to unauthorized access to user data.
Unauthorized access to user data can potentially violate data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.
Therefore, this vulnerability may negatively impact compliance with these standards by exposing user sessions to hijacking risks.