Common Weakness Enumeration

CWE-488 Exposure of Data Element to Wrong Session

Description

The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-488 ordered by modification date.

13 reviewed records

Advisory ID	NVD ID	Severity	PURLs	Summary	Last Modified
GHSA-v3ph-cgqh-r8p5	CVE-2026-82416	HIGH	golang/github.com/dunglas/frankenphp	FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module	2026-10-15
GHSA-c476-6w5q-jw77	CVE-2026-88017	HIGH	golang/github.com/rclone/rclone	rclone: FTP cross-session auth-proxy backend confusion	2026-09-10
GHSA-f23p-vx2j-j53r	CVE-2026-71850	MODERATE	npm/hono	Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure	2026-08-07
GHSA-9c38-2mcm-q7f7	CVE-2026-54311	MODERATE	npm/n8n	n8n: Merge Node SQL Mode Prototype Pollution	2026-07-20
GHSA-9h85-g7w3-rh49	CVE-2026-54497	MODERATE	gem/view_component	ViewComponent: Reused Component Instances Retain Stale Render Context	2026-07-15
GHSA-mfvp-7p3v-x9mh	CVE-2026-9098	CRITICAL	golang/github.com/casdoor/casdoor	Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest	2026-07-02
GHSA-9442-gm4v-r222	CVE-2024-6162	HIGH	maven/io.undertow/undertow-core	Undertow's url-encoded request path information can be broken on ajp-listener	2026-02-27
GHSA-49pc-8936-wvfp	CVE-2026-27492	MODERATE	npm/lettermint	Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused	2026-02-23
GHSA-phg3-gv66-q38x	CVE-2025-1247	HIGH	maven/io.quarkus/quarkus-rest maven/io.quarkus/quarkus-rest-deployment	Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance	2025-03-03
GHSA-7w6r-748w-mh52	CVE-2023-1907	HIGH	pypi/pgadmin4	pgAdmin has Incorrect Default Permissions	2025-02-06
GHSA-82vp-jr39-4j2j	-	HIGH	-	TYPO3 Security Misconfiguration in Frontend Session Handling	2024-05-30
GHSA-wrqv-pf6j-mqjp	CVE-2024-27935	HIGH	-	Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination	2024-03-21
GHSA-97g8-xfvw-q4hg	CVE-2022-3916	MODERATE	maven/org.keycloak/keycloak-parent	Keycloak vulnerable to session takeover with OIDC offline refreshtokens	2023-09-20