CVE-2026-79312
Received Received - Intake

Session Fixation in web.py Web Framework

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: MITRE

Description
webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session from the store, and _save() writes back under the same session_id; no rotation after authentication, so a fixed session_id keeps the authenticated state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-79312
EUVD
EUVD-2026-84489

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
webpy web.py 0.76

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-384 Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79312 is a session fixation vulnerability in web.py 0.76 where the session ID is reused during authentication without rotation. The Session._load() function reads the session ID directly from the request cookie and loads the session, while Session._save() writes back under the same ID. This allows attackers to fix a session ID before a victim logs in, maintaining authenticated access.

Detection Guidance

To detect this vulnerability, inspect web.py applications using session components for session ID reuse during authentication. Check if session IDs are regenerated after login by examining HTTP headers and cookies. Use tools like Burp Suite or browser developer tools to monitor session cookie behavior.

Impact Analysis

If you use web.py 0.76 for authentication, an attacker could hijack your session by setting a session cookie before you log in. This could lead to unauthorized access to your account or sensitive data, depending on the application's functionality.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Compliance may be compromised if user sessions are hijacked, exposing regulated data.

Mitigation Strategies

Immediately implement session regeneration after authentication in your web.py application. Configure secure cookie attributes (SameSite, HttpOnly, Secure). Upgrade web.py if a patch becomes available. Monitor for unauthorized session access or cookie manipulation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79312. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart