Filtered by CWE-384
Filtered by vendor Subscriptions
Total 371 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-24424 1 Jenkins 1 Openid Connect Authentication 2025-04-02 8.8 High
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.
CVE-2023-24456 1 Jenkins 1 Keycloak Authentication 2025-04-02 9.8 Critical
Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.
CVE-2025-27661 1 Printerlogic 2 Vasion Print, Virtual Appliance 2025-04-01 9.1 Critical
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004.
CVE-2023-6800 2025-04-01 0.0 Low
No description is available for this CVE.
CVE-2023-30307 2025-03-28 5.3 Medium
An issue discovered in TP-LINK TL-R473GP-AC, TP-LINK XDR6020, TP-LINK TL-R479GP-AC, TP-LINK TL-R4239G, TP-LINK TL-WAR1200L, and TP-LINK TL-R476G routers allows attackers to hijack TCP sessions which could lead to a denial of service.
CVE-2023-50270 1 Apache 1 Dolphinscheduler 2025-03-18 6.5 Medium
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.
CVE-2025-26658 2025-03-12 6.8 Medium
The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the application to perform unauthorized actions. Due to the improper session management, the attackers can elevate themselves to higher privilege and can read, modify and/or write new data. To gain authenticated sessions of other users, the attacker must invest considerable time and effort. This vulnerability has a high impact on the confidentiality and integrity of the application with no effect on the availability of the application.
CVE-2023-22479 1 Fit2cloud 1 Kubepi 2025-03-11 7.5 High
KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible. A patch will be released in version 1.6.4.
CVE-2022-24895 1 Sensiolabs 1 Symfony 2025-03-11 6.3 Medium
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch.
CVE-2021-36394 1 Moodle 1 Moodle 2025-03-06 9.8 Critical
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.
CVE-2023-27490 1 Nextauth.js 1 Next-auth 2025-02-25 8.1 High
NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to **log in as the victim**, bypassing the CSRF protection. This is due to a partial failure during a compromised OAuth session where a session code is erroneously generated. This issue has been addressed in version 4.20.1. Users are advised to upgrade. Users unable to upgrade may using Advanced Initialization, manually check the callback request for state, pkce, and nonce against the provider configuration to prevent this issue. See the linked GHSA for details.
CVE-2024-25977 2025-02-13 7.3 High
The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect to the login page). This results in the victim's account being taken over.
CVE-2022-31888 1 Enhancesoft 1 Osticket 2025-02-13 8.8 High
Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2.
CVE-2019-10158 2 Infinispan, Redhat 2 Infinispan, Jboss Data Grid 2025-02-13 9.8 Critical
A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.
CVE-2023-26260 1 Oxidforge 1 Oxid Eshop 2025-02-11 5.4 Medium
OXID eShop 6.2.x before 6.4.4 and 6.5.x before 6.5.2 allows session hijacking, leading to partial access of a customer's account by an attacker, due to an improper check of the user agent.
CVE-2023-2105 1 Easyappointments 1 Easyappointments 2025-02-06 8.8 High
Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
CVE-2024-42207 2025-02-05 5.5 Medium
HCL iAutomate is affected by a session fixation vulnerability.  An attacker could hijack a victim's session ID from their authenticated session.
CVE-2025-24503 2025-02-05 N/A
A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server.
CVE-2023-29019 1 Fastify 1 Passport 2025-02-04 8.1 High
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user authentication, in combination with `@fastify/session` as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers. fastify applications rely on the `@fastify/passport` library for user authentication. The login and user validation are performed by the `authenticate` function. When executing this function, the `sessionId` is preserved between the pre-login and the authenticated session. Network and same-site attackers can hijack the victim's session by tossing a valid `sessionId` cookie in the victim's browser and waiting for the victim to log in on the website. As a solution, newer versions of `@fastify/passport` regenerate `sessionId` upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-29020 1 Fastify 1 Passport 2025-02-04 6.5 Medium
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by the `@fastify/csrf-protection` library, when combined with `@fastify/passport` in affected versions, can be bypassed by network and same-site attackers. `fastify/csrf-protection` implements the synchronizer token pattern (using plugins `@fastify/session` and `@fastify/secure-session`) by storing a random value used for CSRF token generation in the `_csrf` attribute of a user's session. The `@fastify/passport` library does not clear the session object upon authentication, preserving the `_csrf` attribute between pre-login and authenticated sessions. Consequently, CSRF tokens generated before authentication are still valid. Network and same-site attackers can thus obtain a CSRF token for their pre-session, fixate that pre-session in the victim's browser via cookie tossing, and then perform a CSRF attack after the victim authenticates. As a solution, newer versions of `@fastify/passport` include the configuration options: `clearSessionOnLogin (default: true)` and `clearSessionIgnoreFields (default: ['passport', 'session'])` to clear all the session attributes by default, preserving those explicitly defined in `clearSessionIgnoreFields`.