CVE-2026-64857

Deferred Deferred - Pending Action

Session Fixation in Tirreno Framework

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call `session_regenerate_id()` afterward. As a result, the session identifier is not rotated on login, it stays the same before and after authentication. An attacker able to fix a known session identifier in a victim's browser (for example through a network man-in-the-middle position, or a separate cross-site scripting or subdomain cookie-injection issue) could then gain access to the victim's authenticated session. The issue is fixed in v0.10.0. The session identifier is now regenerated on successful authentication, and the previous session is destroyed. There is no configuration-level workaround.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-64857

EUVD

EUVD-2026-74954

Affected Vendors & Products

Vendor	Product	Version / Range
tirreno	tirreno	to 0.10.0 (exc)
tirreno_technologies	tirreno	to 0.10.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-384	Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

Executive Summary

CVE-2026-64857 is a session fixation vulnerability in the tirreno security framework affecting versions prior to 0.10.0. During login authentication, the session identifier is not regenerated after validating user credentials. This allows an attacker to fix a known session ID in a victim's browser, potentially gaining unauthorized access to their authenticated session.

Detection Guidance

To detect this vulnerability, check if your tirreno framework version is below 0.10.0. Run commands like 'npm list tirreno' or 'pip show tirreno' to verify the installed version. If the version is older than 0.10.0, the system is vulnerable.

Impact Analysis

An attacker could exploit this to gain access to a victim's authenticated session if they can fix a known session ID in the victim's browser. This could happen through network man-in-the-middle attacks, cross-site scripting, or subdomain cookie-injection issues. The impact includes unauthorized access to sensitive data or functions.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized access to authenticated sessions. Session fixation risks exposing sensitive user data, which may lead to breaches of confidentiality required under these regulations. Organizations using affected versions may face compliance violations if session fixation leads to data exposure.

Mitigation Strategies

Upgrade the tirreno framework to version 0.10.0 or later immediately. There are no configuration-level workarounds, so updating is the only mitigation. Verify the upgrade by checking the version again after installation.

Hi! I’m here to help you understand CVE-2026-64857. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70