MinorCritical vulnerability
CVE-2026-66372 (CVSS 7.6)
NVD · officialPublished Sep 15, 2026Risk 23/100EPSS 0.2%
The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space.
Technical details
CVSS
7.6
AV:AdjacentAC:HighPR:NoneUI:None
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source