CVE-2026-25101

Katalog CVE

CVSS 9.8 · Critical EPSS 0,36%

Kerentanan Session Fixation pada bludit. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enables an attacker to fix a session ID for a victim and later hijack the authenticated session. This issue was fixed in version 3.17.2.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-384: Session Fixation

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert.pl/posts/2026/03/CVE-2026-25099 advisory pihak ketiga
• https://github.com/bludit/bludit/releases/tag/3.17.2 release notes