CVE-2026-71302

Received Received - Intake

Session Fixation in Application

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: ICS-CERT

Description

The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-29

Generated

2026-09-30

AI Q&A

2026-09-30

EPSS Evaluated

N/A

NVD

CVE-2026-71302

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-384	Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

Executive Summary

This vulnerability allows an attacker to take over a user's session by reusing a predefined session ID after the victim authenticates. The application accepts user-supplied session identifiers without regenerating them after login, enabling session hijacking.

Detection Guidance

To detect this vulnerability, monitor session ID reuse by checking if the same session ID is used before and after authentication. Inspect server logs for session fixation attempts or unusual session ID patterns. Use tools like Wireshark to capture and analyze HTTP traffic for session ID exposure in URLs or cookies.

Impact Analysis

An attacker could impersonate you in the application, access your account, perform unauthorized actions, steal sensitive data, or manipulate your session. This could lead to financial loss, data breaches, or reputational damage depending on the application's use.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for protected health information) by allowing unauthorized access to sensitive data. Non-compliance may result in legal penalties or fines.

Mitigation Strategies

Regenerate session IDs after authentication to prevent session fixation. Implement secure session management by using server-generated session IDs and setting HttpOnly and Secure flags for cookies. Enforce session expiration and invalidate old sessions after login.

Hi! I’m here to help you understand CVE-2026-71302. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70