CVE-2026-86279
Received Received - Intake

Session Fixation in Syllabus-Aligned Learning Management System

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The impacted element is an unknown function of the file auth_process.php of the component Login. This manipulation causes session fixiation. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86279
EUVD
EUVD-2026-72273

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sourcecodester syllabus_aligned_learning_management_and_examination_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-384 Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86279 is a session management flaw in the Syllabus-Aligned Learning Management & Examination System 1.0. It involves session fixation in the auth_process.php file during login, allowing attackers to hijack user sessions remotely. The system fails to regenerate session IDs before login, lacks secure cookie flags, and has improper session validation.

Detection Guidance

Check for session fixation vulnerabilities by inspecting auth_process.php for improper session regeneration timing. Look for missing secure cookie flags (HttpOnly, Secure, SameSite) and incomplete logout handling. Review session token exposure in SQL dumps or logs. Use tools like Burp Suite or OWASP ZAP to test session fixation by setting a session ID before login and verifying if it remains valid after authentication.

Impact Analysis

This vulnerability allows attackers to hijack user sessions, bypass authorization checks, and maintain persistent unauthorized access. It can lead to full account compromise, exposure of sensitive data, and potential mass account compromise if combined with default passwords. Attackers may also perform actions on behalf of victims.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for session security and data protection. It risks unauthorized access to personal data, compromising confidentiality and integrity. Organizations may face legal penalties for failing to protect sensitive information under these regulations.

Mitigation Strategies

Immediately enforce secure session settings: regenerate session IDs before login, implement session timeouts, and set HttpOnly, Secure, and SameSite cookie flags. Ensure proper session validation and secure logout procedures. Update auth_process.php to prevent session fixation. Disable default passwords and enforce strong authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86279. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart