Weaknesses of type CWE-384

274 results

Fixação de Sessão

É quando um atacante consegue forçar um usuário a usar um ID de sessão conhecido por ele, geralmente reutilizando a mesma sessão antes e depois do login. Depois que a vítima se autentica com aquele ID fixo, o atacante usa o mesmo ID para acessar a conta sem precisar da senha.

Example

Um site gera um cookie de sessão antes do login. O atacante envia um link com esse ID de sessão para a vítima (ex: www.site.com?jsessionid=ATACANTE123), a vítima clica e faz login normalmente, mas o atacante já tem acesso à mesma sessão autenticada porque o servidor nunca regenerou o ID após a autenticação.

How to mitigate

Regenere o ID de sessão imediatamente após um login bem-sucedido. Valide que o IP ou outros atributos da sessão não mudaram drasticamente entre requisições. Use flags Secure, HttpOnly e SameSite nos cookies de sessão para reduzir vetores de ataque.

CVE-2026-33946HIGHMCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID ReplayEPSS 0.5%CVE-2024-13279CRITICALTwo-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043EPSS 0.5%CVE-2025-46815HIGHZITADEL Allows IdP Intent Token ReuseEPSS 0.5%CVE-2026-64857MEDIUMtirreno has Session Fixation in Login AuthenticationEPSS 0.5%CVE-2023-52353HIGHAn issue was discovered in Mbed TLS through 3.5.1. In mbedtls_ssl_session_reset, the maximum negotiable TLS version is mishandled. For exampEPSS 0.5%CVE-2026-92984HIGHHUBzero CMS through 2.2.32 Session Fixation via Query-String Session IdentifierEPSS 0.5%CVE-2026-56425CRITICALMISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log InjectionEPSS 0.5%CVE-2024-8643CRITICALSession Hijacking in Oceanic Software's ValeAppEPSS 0.5%CVE-2026-92609CRITICALApache Qpid Broker-J: Missing HTTP-session renewal after successful authenticationEPSS 0.5%CVE-2026-22082HIGHInsecure Session ID Management Vulnerability in Tenda Wireless RoutersEPSS 0.5%CVE-2022-33927MEDIUMDell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could exploit this by takinEPSS 0.5%CVE-2026-12581HIGHDigiwin｜EasyFlow .NET - Session FixationEPSS 0.5%CVE-2025-67446CRITICALImproper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before. The router uses a weak/predictabEPSS 0.5%CVE-2022-43529MEDIUMA vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an remote attacker to persistEPSS 0.5%CVE-2025-45953CRITICALA vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change PassEPSS 0.4%CVE-2026-84652HIGHIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember meEPSS 0.4%CVE-2023-4649MEDIUMSession Fixation in instantsoft/icms2EPSS 0.4%CVE-2024-2260MEDIUMSession Fixation Vulnerability in zenml-io/zenmlEPSS 0.4%CVE-2026-55682HIGHWeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.phpEPSS 0.4%CVE-2024-56529HIGHMailcow through 2024-11b has a session fixation vulnerability in the web panel. It allows remote attackers to set a session identifier when EPSS 0.4%