Predictable Session Identifier in ntopng Leads to Session Hijacking

Publication date: 2026-07-02

Last updated on: 2026-07-08

Assigner: MITRE

Description

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-02

Last Modified

2026-07-08

Generated

2026-07-23

AI Q&A

2026-07-03

EPSS Evaluated

2026-07-21

NVD

CVE-2026-38968

Affected Vendors & Products

Vendor	Product	Version / Range
ntop	ntopng	to 6.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-341	A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.

Attack-Flow Graph

Executive Summary

This vulnerability affects ntopng through version 6.6 and involves predictable session identifiers. Specifically, the HTTP session identifiers generated in the source file src/HTTPserver.cpp use weak time-seeded pseudo-randomness when creating sessions. This weakness allows an attacker to predict or cause collisions in session cookies for fresh authenticated logins by controlling the timing of session creation.

Impact Analysis

The vulnerability can lead to session hijacking, where an attacker can take over a user's authenticated session by predicting or forcing the session identifier. This compromises the security of user sessions, potentially allowing unauthorized access to sensitive information or actions within the ntopng application.

Hi! I’m here to help you understand CVE-2026-38968. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70