CWE-384

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125078",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T16:57:24.615786Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T18:04:04.135Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:sourcecodester:smart_attendance_system_with_qr_code_scanner:*:*:*:*:*:*:*:*"
          ],
          "product": "Smart Attendance System with QR Code Scanner",
          "vendor": "SourceCodester",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yuechuya (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-384",
              "description": "Session Fixiation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T00:00:27.929Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-433183 | SourceCodester Smart Attendance System with QR Code Scanner login.php session fixiation",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/433183"
        },
        {
          "name": "VDB-433183 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/433183/cti"
        },
        {
          "name": "CVE-2026-125078 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-125078"
        },
        {
          "name": "Submit #1041017 | SourceCodester Smart Attendance System with QR Code Scanner 1.0 Session Fixation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1041017"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-06-Session-Fixation.md"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.sourcecodester.com/"
        }
      ],
      "tags": [
        "x_freeware"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-09T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-09T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-09T18:02:55.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "SourceCodester Smart Attendance System with QR Code Scanner login.php session fixiation",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-125078",
    "datePublished": "2026-11-10T00:00:27.929Z",
    "dateReserved": "2026-11-09T16:56:43.676Z",
    "dateUpdated": "2026-11-12T18:04:04.135Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123801",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T19:01:45.689414Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T19:11:09.674Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "supertokens-core",
          "vendor": "supertokens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 11.3.0, \u003c 11.3.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 11.4.0, \u003c 11.4.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 12.0.0, \u003c 12.0.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 12.1.0, \u003c 12.1.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 12.2.0, \u003c 12.2.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 12.3.0, \u003c 12.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiated flow, an attacker who obtains a legitimately issued, still-valid SAML response and its matching RelayState can resubmit the pair to /recipe/saml/callback before the assertion\u0027s NotOnOrAfter time; in the IdP-initiated flow, the assertion can be replayed without RelayState. The missing Response.InResponseTo check also permits an in-progress login to be completed with an assertion for a different identity and fails to enforce allowIDPInitiatedLogin=false. The callback does not validate Destination or SubjectConfirmationData Recipient and NotOnOrAfter, and each accepted callback mints a fresh, independently redeemable authorization code carrying the captured user\u0027s identity. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-294",
              "description": "CWE-294: Authentication Bypass by Capture-replay",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-384",
              "description": "CWE-384: Session Fixation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T18:18:47.322Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-3r7x-rhvc-fw28",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-3r7x-rhvc-fw28"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/commit/075655222f5e72f3683a127e45c83c4174fbd4f7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/commit/075655222f5e72f3683a127e45c83c4174fbd4f7"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/commit/4e05d8cf60287e9d2720140031a8b8f4430d056f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/commit/4e05d8cf60287e9d2720140031a8b8f4430d056f"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/commit/557835406547d269f5d0e33159630a1873461c38",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/commit/557835406547d269f5d0e33159630a1873461c38"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/commit/5c42f02e98f67174c6a5a800dd9f8bd5b6e98486",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/commit/5c42f02e98f67174c6a5a800dd9f8bd5b6e98486"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/commit/b6730e608b2d4562939cd4f41ea07df5f841dfe5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/commit/b6730e608b2d4562939cd4f41ea07df5f841dfe5"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/commit/ca2bca9bc900c2fd399d508818ad026cc977dcf6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/commit/ca2bca9bc900c2fd399d508818ad026cc977dcf6"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-3r7x-rhvc-fw28",
        "discovery": "UNKNOWN"
      },
      "title": "SuperTokens Core: SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replay"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123801",
    "datePublished": "2026-11-09T18:18:47.322Z",
    "dateReserved": "2026-11-06T15:27:56.226Z",
    "dateUpdated": "2026-11-10T19:11:09.674Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121501",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T03:24:44.849182Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T03:24:53.593Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"
          ],
          "product": "CloudClassroom-PHP-Project",
          "vendor": "mathurvishal",
          "versions": [
            {
              "status": "affected",
              "version": "5dadec098bfbbf3300d60c3494db3fb95b66e7be"
            },
            {
              "status": "affected",
              "version": "c46ce5736007d9d6e51a8feeb9250729fe85f139"
            },
            {
              "status": "affected",
              "version": "dae0c5961a35a4faf28cde9e02117538f09f81c1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "rmsbpro (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. The affected element is the function session_regenerate_id of the file loginlinkadmin.php. Executing a manipulation of the argument PHPSESSID can lead to session fixiation. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-384",
              "description": "Session Fixiation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:00:21.523Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-430283 | mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/430283"
        },
        {
          "name": "VDB-430283 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/430283/cti"
        },
        {
          "name": "CVE-2026-121501 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-121501"
        },
        {
          "name": "Submit #1019357 | https://github.com/mathurvishal/CloudClassroom-PHP-Project CloudClassroom-PHP-Project 5dadec098bfbbf3300d60c3494db3fb95b66e7be Session Fixation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1019357"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/rmsbpro/Advisory/blob/main/session-fixation.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-03T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-03T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-03T15:21:16.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-121501",
    "datePublished": "2026-11-03T19:00:21.523Z",
    "dateReserved": "2026-11-03T14:16:04.130Z",
    "dateUpdated": "2026-11-07T03:24:53.593Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119446",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T17:48:38.519155Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T17:48:56.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-9vr9-463q-46qp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://ghcr.io",
          "cpes": [
            "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.NervesHubWeb.API.UserController\u0027",
            "\u0027Elixir.NervesHubWeb.SessionController\u0027",
            "\u0027Elixir.NervesHub.Accounts\u0027",
            "\u0027Elixir.NervesHubWeb.Router\u0027"
          ],
          "packageName": "nerves-hub/nerves-hub",
          "packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub",
          "product": "nerves_hub_web",
          "programFiles": [
            "lib/nerves_hub_web/controllers/api/user_controller.ex",
            "lib/nerves_hub_web/controllers/session_controller.ex",
            "lib/nerves_hub/accounts.ex",
            "lib/nerves_hub_web/router.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.NervesHubWeb.API.UserController\u0027:cli_session/2"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.API.UserController\u0027:check_cli_session/2"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.SessionController\u0027:cli/2"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.SessionController\u0027:cli_confirm/2"
            },
            {
              "name": "\u0027Elixir.NervesHub.Accounts\u0027:generate_cli_session_token/1"
            },
            {
              "name": "\u0027Elixir.NervesHub.Accounts\u0027:cli_session_waiting?/2"
            },
            {
              "name": "\u0027Elixir.NervesHub.Accounts\u0027:verify_cli_session_token/2"
            }
          ],
          "vendor": "nerves-hub",
          "versions": [
            {
              "lessThan": "2.5.3",
              "status": "affected",
              "version": "2.5.0",
              "versionType": "other"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.NervesHubWeb.API.UserController\u0027",
            "\u0027Elixir.NervesHubWeb.SessionController\u0027",
            "\u0027Elixir.NervesHub.Accounts\u0027",
            "\u0027Elixir.NervesHubWeb.Router\u0027"
          ],
          "packageName": "nerves_hub",
          "packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git",
          "product": "nerves_hub_web",
          "programFiles": [
            "lib/nerves_hub_web/controllers/api/user_controller.ex",
            "lib/nerves_hub_web/controllers/session_controller.ex",
            "lib/nerves_hub/accounts.ex",
            "lib/nerves_hub_web/router.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.NervesHubWeb.API.UserController\u0027:cli_session/2"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.API.UserController\u0027:check_cli_session/2"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.SessionController\u0027:cli/2"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.SessionController\u0027:cli_confirm/2"
            },
            {
              "name": "\u0027Elixir.NervesHub.Accounts\u0027:generate_cli_session_token/1"
            },
            {
              "name": "\u0027Elixir.NervesHub.Accounts\u0027:cli_session_waiting?/2"
            },
            {
              "name": "\u0027Elixir.NervesHub.Accounts\u0027:verify_cli_session_token/2"
            }
          ],
          "repo": "https://github.com/nerves-hub/nerves_hub_web",
          "vendor": "nerves-hub",
          "versions": [
            {
              "lessThan": "2.5.3",
              "status": "affected",
              "version": "2.5.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.NervesHubWeb.API.UserController\u0027",
            "\u0027Elixir.NervesHubWeb.SessionController\u0027",
            "\u0027Elixir.NervesHub.Accounts\u0027",
            "\u0027Elixir.NervesHubWeb.Router\u0027"
          ],
          "packageName": "nerves-hub/nerves_hub_web",
          "packageURL": "pkg:github/nerves-hub/nerves_hub_web",
          "product": "nerves_hub_web",
          "programFiles": [
            "lib/nerves_hub_web/controllers/api/user_controller.ex",
            "lib/nerves_hub_web/controllers/session_controller.ex",
            "lib/nerves_hub/accounts.ex",
            "lib/nerves_hub_web/router.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.NervesHubWeb.API.UserController\u0027:cli_session/2"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.API.UserController\u0027:check_cli_session/2"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.SessionController\u0027:cli/2"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.SessionController\u0027:cli_confirm/2"
            },
            {
              "name": "\u0027Elixir.NervesHub.Accounts\u0027:generate_cli_session_token/1"
            },
            {
              "name": "\u0027Elixir.NervesHub.Accounts\u0027:cli_session_waiting?/2"
            },
            {
              "name": "\u0027Elixir.NervesHub.Accounts\u0027:verify_cli_session_token/2"
            }
          ],
          "repo": "https://github.com/nerves-hub/nerves_hub_web",
          "vendor": "nerves-hub",
          "versions": [
            {
              "lessThan": "3131f1701194b581ab4b3e5e9d81194fc9c83508",
              "status": "affected",
              "version": "e6bf11a812d7aa8b69d854ba8ef02d65516f5564",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.5.3",
                  "versionStartIncluding": "2.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Amr Kadry"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Amr Kadry"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Josh Kalderimis"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-11-09T22:12:23.000Z",
      "datePublic": "2026-11-10T10:44:15.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSession Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user\u0027s account via a crafted login link. Starting a CLI login with \u003ccode\u003ePOST /api/auth/cli_session\u003c/code\u003e needs no authentication and returns a polling token, a confirmation URL that carries that token, and a confirmation code. When a signed-in user opens that URL and clicks Confirm, \u003ccode\u003eNervesHub.Accounts.verify_cli_session_token/2\u003c/code\u003e creates an API token for the user\u0027s account and stores it on the login, and the next poll of \u003ccode\u003eGET /api/auth/cli_session/\u0026lt;token\u0026gt;\u003c/code\u003e returns it to whoever started the login.\u003c/p\u003e\n\u003cp\u003eThe confirmation code is only displayed and is never compared with anything, so it cannot show that the person confirming is the one who started the login. The confirm form carries a CSRF token and the page cannot be framed, so the attacker has to persuade the user to open the link and click the button themselves.\u003c/p\u003e\n\u003cp\u003eThis issue affects nerves_hub: from 2.5.0 before 2.5.3.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user\u0027s account via a crafted login link. Starting a CLI login with `POST /api/auth/cli_session` needs no authentication and returns a polling token, a confirmation URL that carries that token, and a confirmation code. When a signed-in user opens that URL and clicks Confirm, `NervesHub.Accounts.verify_cli_session_token/2` creates an API token for the user\u0027s account and stores it on the login, and the next poll of `GET /api/auth/cli_session/\u003ctoken\u003e` returns it to whoever started the login.\n\nThe confirmation code is only displayed and is never compared with anything, so it cannot show that the person confirming is the one who started the login. The confirm form carries a CSRF token and the page cannot be framed, so the attacker has to persuade the user to open the link and click the button themselves.\n\nThis issue affects nerves_hub: from 2.5.0 before 2.5.3."
            }
          ],
          "value": "Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user\u0027s account via a crafted login link. Starting a CLI login with POST /api/auth/cli_session needs no authentication and returns a polling token, a confirmation URL that carries that token, and a confirmation code. When a signed-in user opens that URL and clicks Confirm, NervesHub.Accounts.verify_cli_session_token/2 creates an API token for the user\u0027s account and stores it on the login, and the next poll of GET /api/auth/cli_session/\u003ctoken\u003e returns it to whoever started the login.\n\nThe confirmation code is only displayed and is never compared with anything, so it cannot show that the person confirming is the one who started the login. The confirm form carries a CSRF token and the page cannot be framed, so the attacker has to persuade the user to open the link and click the button themselves.\n\nThis issue affects nerves_hub: from 2.5.0 before 2.5.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-61",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn attacker with no account obtains an API token for any NervesHub user they can persuade to open a link and click Confirm. The token acts as that user through the API in every organization they belong to, at their role, until the user deletes it on the account page. Signing out of the web does not revoke it.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "An attacker with no account obtains an API token for any NervesHub user they can persuade to open a link and click Confirm. The token acts as that user through the API in every organization they belong to, at their role, until the user deletes it on the account page. Signing out of the web does not revoke it."
                }
              ],
              "value": "An attacker with no account obtains an API token for any NervesHub user they can persuade to open a link and click Confirm. The token acts as that user through the API in every organization they belong to, at their role, until the user deletes it on the account page. Signing out of the web does not revoke it."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-384",
              "description": "CWE-384 Session Fixation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T17:11:05.623Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "CLI login links give an API token to whoever sent them",
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-9vr9-463q-46qp"
        },
        {
          "name": "EEF CNA record for CVE-2026-119446",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-119446.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-119446",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-119446"
        },
        {
          "name": "Introducing commit e6bf11a in nerves-hub/nerves_hub_web",
          "tags": [
            "related"
          ],
          "url": "https://github.com/nerves-hub/nerves_hub_web/commit/e6bf11a812d7aa8b69d854ba8ef02d65516f5564"
        },
        {
          "name": "Fix commit 3131f17 in nerves-hub/nerves_hub_web",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/nerves-hub/nerves_hub_web/commit/3131f1701194b581ab4b3e5e9d81194fc9c83508"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrading does not revoke tokens already handed out. A token from a CLI login is an ordinary API token with a note the client chose, so one an attacker obtained looks like any other. After upgrading, users should review their API tokens on the account page and delete any they do not recognise.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Upgrading does not revoke tokens already handed out. A token from a CLI login is an ordinary API token with a note the client chose, so one an attacker obtained looks like any other. After upgrading, users should review their API tokens on the account page and delete any they do not recognise."
            }
          ],
          "value": "Upgrading does not revoke tokens already handed out. A token from a CLI login is an ordinary API token with a note the client chose, so one an attacker obtained looks like any other. After upgrading, users should review their API tokens on the account page and delete any they do not recognise."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user\u0027s API token",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eBlock \u003ccode\u003ePOST /api/auth/cli_session\u003c/code\u003e at the reverse proxy until the upgrade. It is the only entry point that creates a CLI login, so no link can be produced while it is blocked. CLIs can still sign in with an email and password (\u003ccode\u003enh user auth\u003c/code\u003e, \u003ccode\u003ePOST /api/users/auth\u003c/code\u003e), or use an API token created on the account page.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Block `POST /api/auth/cli_session` at the reverse proxy until the upgrade. It is the only entry point that creates a CLI login, so no link can be produced while it is blocked. CLIs can still sign in with an email and password (`nh user auth`, `POST /api/users/auth`), or use an API token created on the account page."
            }
          ],
          "value": "Block POST /api/auth/cli_session at the reverse proxy until the upgrade. It is the only entry point that creates a CLI login, so no link can be produced while it is blocked. CLIs can still sign in with an email and password (nh user auth, POST /api/users/auth), or use an API token created on the account page."
        }
      ],
      "x_proofOfConcept": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003col\u003e\n\u003cli\u003eWith no account, run \u003ccode\u003ecurl -X POST https://\u0026lt;host\u0026gt;/api/auth/cli_session\u003c/code\u003e. Note \u003ccode\u003etoken\u003c/code\u003e, \u003ccode\u003eurl\u003c/code\u003e and \u003ccode\u003econfirmation_code\u003c/code\u003e from the response.\u003c/li\u003e\n\u003cli\u003eSend \u003ccode\u003eurl\u003c/code\u003e to someone with a NervesHub account, with a message such as \"Please verify your NervesHub CLI access. Your code is \u003ccode\u003e\u0026lt;confirmation_code\u0026gt;\u003c/code\u003e.\"\u003c/li\u003e\n\u003cli\u003eThey open it while signed in, see the code they were told to expect, and click \"Confirm login\".\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003ecurl https://\u0026lt;host\u0026gt;/api/auth/cli_session/\u0026lt;token\u0026gt;\u003c/code\u003e returns \u003ccode\u003e\"status\": \"ready\"\u003c/code\u003e and a \u003ccode\u003euser_token\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend API requests with \u003ccode\u003eAuthorization: token \u0026lt;user_token\u0026gt;\u003c/code\u003e. They run as the person who confirmed.\u003c/li\u003e\n\u003c/ol\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "1. With no account, run `curl -X POST https://\u003chost\u003e/api/auth/cli_session`. Note `token`, `url` and `confirmation_code` from the response.\n2. Send `url` to someone with a NervesHub account, with a message such as \"Please verify your NervesHub CLI access. Your code is `\u003cconfirmation_code\u003e`.\"\n3. They open it while signed in, see the code they were told to expect, and click \"Confirm login\".\n4. `curl https://\u003chost\u003e/api/auth/cli_session/\u003ctoken\u003e` returns `\"status\": \"ready\"` and a `user_token`.\n5. Send API requests with `Authorization: token \u003cuser_token\u003e`. They run as the person who confirmed."
            }
          ],
          "value": "* With no account, run curl -X POST https://\u003chost\u003e/api/auth/cli_session. Note token, url and confirmation_code from the response.\n* Send url to someone with a NervesHub account, with a message such as \"Please verify your NervesHub CLI access. Your code is \u003cconfirmation_code\u003e.\"\n* They open it while signed in, see the code they were told to expect, and click \"Confirm login\".\n* curl https://\u003chost\u003e/api/auth/cli_session/\u003ctoken\u003e returns \"status\": \"ready\" and a user_token.\n* Send API requests with Authorization: token \u003cuser_token\u003e. They run as the person who confirmed."
        }
      ],
      "x_technicalAnalysis": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003e1. Starting a login.\u003c/strong\u003e \u003ccode\u003enh user login\u003c/code\u003e, like any client of this flow, calls \u003ccode\u003ePOST /api/auth/cli_session\u003c/code\u003e, which needs no authentication. \u003ccode\u003eNervesHubWeb.API.UserController.cli_session/2\u003c/code\u003e calls \u003ccode\u003eNervesHub.Accounts.generate_cli_session_token/1\u003c/code\u003e, which stores a waiting login in the CLI session cache under a random UUID token with a six-digit confirmation code, and responds with the token, the code, and the URL \u003ccode\u003e/auth/cli/\u0026lt;token\u0026gt;\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Approving a login.\u003c/strong\u003e \u003ccode\u003eGET /auth/cli/\u0026lt;token\u0026gt;\u003c/code\u003e requires a signed-in web user. \u003ccode\u003eNervesHubWeb.SessionController.cli/2\u003c/code\u003e finds the login by the token from the URL, shows the code, and renders a form that posts back to \u003ccode\u003e/auth/cli/\u0026lt;token\u0026gt;\u003c/code\u003e. The form carries no code field. \u003ccode\u003ecli_confirm/2\u003c/code\u003e passes the signed-in user and the token to \u003ccode\u003eNervesHub.Accounts.verify_cli_session_token/2\u003c/code\u003e, which creates an API token for that user with \u003ccode\u003ecreate_user_api_token/2\u003c/code\u003e and stores it on the login. Nothing compares the confirmation code with anything.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Collecting the token.\u003c/strong\u003e \u003ccode\u003eGET /api/auth/cli_session/\u0026lt;token\u0026gt;\u003c/code\u003e, also unauthenticated, returns the stored API token once the login is confirmed. Whoever started the login holds the token from step 1 and can poll until it arrives. The token is an ordinary API token and stays valid until the user deletes it.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "**1. Starting a login.** `nh user login`, like any client of this flow, calls `POST /api/auth/cli_session`, which needs no authentication. `NervesHubWeb.API.UserController.cli_session/2` calls `NervesHub.Accounts.generate_cli_session_token/1`, which stores a waiting login in the CLI session cache under a random UUID token with a six-digit confirmation code, and responds with the token, the code, and the URL `/auth/cli/\u003ctoken\u003e`.\n\n**2. Approving a login.** `GET /auth/cli/\u003ctoken\u003e` requires a signed-in web user. `NervesHubWeb.SessionController.cli/2` finds the login by the token from the URL, shows the code, and renders a form that posts back to `/auth/cli/\u003ctoken\u003e`. The form carries no code field. `cli_confirm/2` passes the signed-in user and the token to `NervesHub.Accounts.verify_cli_session_token/2`, which creates an API token for that user with `create_user_api_token/2` and stores it on the login. Nothing compares the confirmation code with anything.\n\n**3. Collecting the token.** `GET /api/auth/cli_session/\u003ctoken\u003e`, also unauthenticated, returns the stored API token once the login is confirmed. Whoever started the login holds the token from step 1 and can poll until it arrives. The token is an ordinary API token and stays valid until the user deletes it."
            }
          ],
          "value": "1. Starting a login. nh user login, like any client of this flow, calls POST /api/auth/cli_session, which needs no authentication. NervesHubWeb.API.UserController.cli_session/2 calls NervesHub.Accounts.generate_cli_session_token/1, which stores a waiting login in the CLI session cache under a random UUID token with a six-digit confirmation code, and responds with the token, the code, and the URL /auth/cli/\u003ctoken\u003e.\n\n2. Approving a login. GET /auth/cli/\u003ctoken\u003e requires a signed-in web user. NervesHubWeb.SessionController.cli/2 finds the login by the token from the URL, shows the code, and renders a form that posts back to /auth/cli/\u003ctoken\u003e. The form carries no code field. cli_confirm/2 passes the signed-in user and the token to NervesHub.Accounts.verify_cli_session_token/2, which creates an API token for that user with create_user_api_token/2 and stores it on the login. Nothing compares the confirmation code with anything.\n\n3. Collecting the token. GET /api/auth/cli_session/\u003ctoken\u003e, also unauthenticated, returns the stored API token once the login is confirmed. Whoever started the login holds the token from step 1 and can poll until it arrives. The token is an ordinary API token and stays valid until the user deletes it."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-119446",
    "datePublished": "2026-11-10T10:44:15.336Z",
    "dateReserved": "2026-11-07T21:44:37.269Z",
    "dateUpdated": "2026-11-12T17:48:56.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115910",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-31T01:33:39.142281Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-31T01:34:08.259Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/python-social-auth/social-core/security/advisories/GHSA-h2r5-x5m7-3935"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "social-core",
          "vendor": "python-social-auth",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get_and_store_nonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only that the nonce exists and has not expired rather than binding it to the browser session and OAuth state that initiated the login. An attacker who obtains a victim\u0027s unused authorization code can start a separate login to obtain valid state for the attacker\u0027s browser, submit the victim\u0027s code with that state, and pass nonce validation because the victim nonce is globally available. With DEFAULT_USE_PKCE disabled in the default OpenIdConnectAuth configuration, the attacker can be logged in as the victim. This issue is fixed in version 6.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-384",
              "description": "CWE-384: Session Fixation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T16:44:34.337Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/python-social-auth/social-core/security/advisories/GHSA-h2r5-x5m7-3935",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/python-social-auth/social-core/security/advisories/GHSA-h2r5-x5m7-3935"
        },
        {
          "name": "https://github.com/python-social-auth/social-core/pull/2141",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-social-auth/social-core/pull/2141"
        },
        {
          "name": "https://github.com/python-social-auth/social-core/commit/c2f2ae4663bef19ee8b07f2cf5a2344f9155d826",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-social-auth/social-core/commit/c2f2ae4663bef19ee8b07f2cf5a2344f9155d826"
        },
        {
          "name": "https://github.com/python-social-auth/social-core/releases/tag/6.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-social-auth/social-core/releases/tag/6.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-h2r5-x5m7-3935",
        "discovery": "UNKNOWN"
      },
      "title": "Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-115910",
    "datePublished": "2026-10-26T16:44:34.337Z",
    "dateReserved": "2026-10-23T20:21:45.106Z",
    "dateUpdated": "2026-10-31T01:34:08.259Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107421",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T10:51:07.517158Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T16:43:48.193Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "videowhisper-live-streaming-integration",
          "product": "Broadcast Live Video",
          "vendor": "VideoWhisper.com",
          "versions": [
            {
              "changes": [
                {
                  "at": "7.3.3",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "7.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Tang | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-12T11:58:08.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.\u003cp\u003eThis issue affects Broadcast Live Video: from n/a through 7.3.2.\u003c/p\u003e"
            }
          ],
          "value": "Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-593",
          "descriptions": [
            {
              "lang": "en",
              "value": "Session Hijacking"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-384",
              "description": "Session Fixation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T12:08:27.906Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/videowhisper-live-streaming-integration/vulnerability/wordpress-broadcast-live-video-plugin-7-3-2-session-hijacking-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Broadcast Live Video plugin to the latest available version (at least 7.3.3)."
            }
          ],
          "value": "Update the WordPress Broadcast Live Video plugin to the latest available version (at least 7.3.3)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Broadcast Live Video plugin \u003c= 7.3.2 - Session Hijacking vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-107421",
    "datePublished": "2026-10-14T12:08:27.906Z",
    "dateReserved": "2026-10-08T00:19:19.565Z",
    "dateUpdated": "2026-10-15T16:43:48.193Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107229",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T15:26:09.891337Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:57:44.807Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "async-http-client",
          "vendor": "AsyncHttpClient",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.11, \u003c 3.0.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.16.0, \u003c= 2.16.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent A-label normalization, locale-sensitive lowercasing, public-suffix host-only handling, and numeric or IP host checks allow one origin to store a cookie later sent to another origin. Applications sharing one client across trust domains can therefore receive attacker-injected cookies and may be exposed to session fixation. This issue is fixed in version 3.0.14."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-384",
              "description": "CWE-384: Session Fixation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1275",
              "description": "CWE-1275: Sensitive Cookie with Improper SameSite Attribute",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T20:57:36.676Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-qjr7-w8pj-pmv9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-qjr7-w8pj-pmv9"
        },
        {
          "name": "https://github.com/AsyncHttpClient/async-http-client/commit/7dc5bbc2d0a48aa2a9caf089a626dcfd333168e9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AsyncHttpClient/async-http-client/commit/7dc5bbc2d0a48aa2a9caf089a626dcfd333168e9"
        },
        {
          "name": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14"
        }
      ],
      "source": {
        "advisory": "GHSA-qjr7-w8pj-pmv9",
        "discovery": "UNKNOWN"
      },
      "title": "AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107229",
    "datePublished": "2026-10-07T20:57:36.676Z",
    "dateReserved": "2026-10-07T14:34:14.817Z",
    "dateUpdated": "2026-10-08T17:57:44.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107226",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T20:13:26.081737Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T20:25:00.134Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "async-http-client",
          "vendor": "AsyncHttpClient",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c= 2.16.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.0.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received over plaintext and permits insecure cookies to overlay or delete existing Secure cookies with matching scope. An attacker controlling a plaintext same-site response can consequently plant, replace, or remove cookie state later sent to an HTTPS origin, enabling session fixation, CSRF-token replacement, or loss of security-relevant state. This issue is fixed in version 3.0.14."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-384",
              "description": "CWE-384: Session Fixation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T18:34:18.996Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-p2jm-6hj6-9rjg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-p2jm-6hj6-9rjg"
        },
        {
          "name": "https://github.com/AsyncHttpClient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AsyncHttpClient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1"
        },
        {
          "name": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14"
        }
      ],
      "source": {
        "advisory": "GHSA-p2jm-6hj6-9rjg",
        "discovery": "UNKNOWN"
      },
      "title": "AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107226",
    "datePublished": "2026-10-12T18:34:18.996Z",
    "dateReserved": "2026-10-07T14:34:14.816Z",
    "dateUpdated": "2026-10-13T20:25:00.134Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107124",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T04:48:13.625066Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T04:48:27.607Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-operator-bundle",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6.8-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6-24",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9-operator",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6-24",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat build of Keycloak 26.6.8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.6.8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7"
          ],
          "defaultStatus": "affected",
          "packageName": "keycloak-services",
          "product": "Red Hat Single Sign-On 7",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Adam Korczynski (Ada Logics Ltd) and Anthropic for reporting this issue."
        }
      ],
      "datePublic": "2026-11-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination in Red Hat Build of Keycloak. The issue occurs because the system sets a session cookie based on an unvalidated token hint before completing security checks. An attacker can use this flaw to fix a session ID in a victim\u0027s browser, allowing them to hijack the victim\u0027s subsequent login and gain full control over their account."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-384",
              "description": "Session Fixation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T17:34:42.126Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:95761",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:95761"
        },
        {
          "name": "RHSA-2026:95762",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:95762"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-107124"
        },
        {
          "name": "RHBZ#2547298",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547298"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-06T14:42:31.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-11-05T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_hint leading to account takeover",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-384: Session Fixation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-107124",
    "datePublished": "2026-11-06T05:57:23.296Z",
    "dateReserved": "2026-10-07T07:40:44.616Z",
    "dateUpdated": "2026-11-10T04:48:27.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105233",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T14:17:55.160609Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T14:19:00.804Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:kishor-23:food-waste-management-system:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Login Flow"
          ],
          "product": "food-waste-management-system",
          "vendor": "kishor-23",
          "versions": [
            {
              "status": "affected",
              "version": "411989e3ecb82895e53dca7865f72145f03d7d93"
            },
            {
              "status": "affected",
              "version": "b3a70b2c492dc9904de5be1ad9389bd79b87f82c"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "liaoxijun10086 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file login.php of the component Login Flow. Such manipulation of the argument PHPSESSID leads to session fixiation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-384",
              "description": "Session Fixiation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T05:45:09.492Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413433 | kishor-23 food-waste-management-system Login Flow login.php session fixiation",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413433"
        },
        {
          "name": "VDB-413433 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413433/cti"
        },
        {
          "name": "CVE-2026-105233 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-105233"
        },
        {
          "name": "Submit #972904 | kishor-23 food-waste-management-system food-waste-management-system Session Fixiation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/972904"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/kishor-23/food-waste-management-system/issues/16"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/kishor-23/food-waste-management-system/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-04T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-04T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-04T16:09:13.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "kishor-23 food-waste-management-system Login Flow login.php session fixiation",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-105233",
    "datePublished": "2026-10-05T05:45:09.492Z",
    "dateReserved": "2026-10-04T13:58:25.026Z",
    "dateUpdated": "2026-10-05T14:19:00.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}