CWE-384 Session Fixation
Description
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-384 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-p2jm-6hj6-9rjg | CVE-2026-107226 | MODERATE |
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS |
2026-10-08 | |
| GHSA-vqg6-3fw6-j9jg | CVE-2026-57179 | MODERATE |
social-auth-core has a Session Fixation issue |
2026-09-24 | |
| GHSA-phg3-3g28-wq9v | CVE-2026-61687 | HIGH |
Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState |
2026-09-21 | |
| GHSA-f795-p5jw-j6g2 | CVE-2026-61592 | HIGH |
djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack) |
2026-09-16 | |
| GHSA-wv64-j4fq-5f9x | CVE-2026-69214 | MODERATE |
Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain |
2026-09-15 | |
| GHSA-7mpp-r37j-x5wh | CVE-2026-70594 | MODERATE |
Ghost: Session Fixation in Ghost Admin |
2026-08-04 | |
| GHSA-f7vp-7xgx-4w4r | CVE-2026-69245 | MODERATE | - |
Guzzle: Noncanonical cookie domain keeps subdomain scope |
2026-08-03 |
| GHSA-4hfh-6x8g-gwpp | CVE-2026-41839 | MODERATE |
Spring Framework Escalation via Session Fixation in WebFlux |
2026-07-30 | |
| GHSA-g446-98w2-8p5w | CVE-2026-59883 | MODERATE | - |
Guzzle: Cookie Disclosure and Injection via IP-Address Domains |
2026-07-20 |
| GHSA-5qfp-32cf-69jh | - | HIGH | - |
SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers |
2026-07-01 |
| GHSA-7hp7-4p35-3cx2 | CVE-2026-48545 | HIGH |
Gradio contains a cookie injection vulnerability |
2026-07-01 | |
| GHSA-23hv-mwm6-g8jf | CVE-2025-55668 | MODERATE |
Apache Tomcat Session Fixation vulnerability |
2026-07-01 | |
| GHSA-fcvm-3cpj-f9qx | CVE-2026-43827 | MODERATE |
Apache Shiro has a session fixation vulnerability |
2026-06-30 | |
| GHSA-gq25-78jf-v78c | CVE-2025-65681 | LOW |
Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control |
2026-06-08 | |
| GHSA-45m8-cpm2-3v65 | CVE-2026-44553 | HIGH |
Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access |
2026-05-15 | |
| GHSA-qpjw-p3jg-59j6 | CVE-2026-40010 | CRITICAL |
Apache Wicket has a Session Fixation issue |
2026-05-11 | |
| GHSA-f24x-5g9q-753f | CVE-2026-34454 | LOW |
OAuth2 Proxy's session cookies are not cleared when rendering sign-in page |
2026-04-15 | |
| GHSA-qvqr-5cv7-wh35 | CVE-2026-33946 | HIGH |
MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay |
2026-03-30 | |
| GHSA-7q7g-x6vg-xpc3 | CVE-2026-33757 | CRITICAL |
OpenBao lacks user confirmation for OIDC direct callback mode |
2026-03-27 | |
| GHSA-x3pr-vrhq-vq43 | CVE-2026-33492 | HIGH | - |
AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration |
2026-03-25 |
| GHSA-gq2m-77hf-vwgh | CVE-2026-30224 | MODERATE |
OliveTin Session Fixation: Logout Fails to Invalidate Server-Side Session |
2026-03-06 | |
| GHSA-vf6j-6739-78m8 | CVE-2023-22648 | HIGH |
Rancher's Azure AD permission changes are not reflected on active sessions |
2026-03-03 | |
| GHSA-r3xh-3r3w-47gp | CVE-2026-24894 | HIGH |
FrankenPHP leaks session data between requests in worker mode |
2026-02-12 | |
| GHSA-c7vg-w8q8-c3wf | - | MODERATE | - |
Duplicate Advisory: Session Fixation |
2026-02-02 |
| GHSA-4m5p-5w5w-3jcf | CVE-2024-23679 | CRITICAL |
com.enonic.xp:lib-auth vulnerable to Session Fixation |
2026-01-22 |