MinorCritical vulnerability
CVE-2026-71302 (CVSS 7.5)
NVD · officialPublished Sep 29, 2026Risk 23/100
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover.
Technical details
CVSS
7.5
AV:NetworkAC:HighPR:NoneUI:Active
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source