https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 10:19:41 +0000 https://vulnerability.circl.lu/vuln/cve-2026-64857 <p><strong>Affected:</strong> tirrenotechnologies tirreno</p> <p>tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user&#39;s credentials and establishes the authenticated session, but it does not call `session_regenerate_id()` afterward. As a result, the session identifier is not rotated on login, it stays the same before and after authentication. An attacker able to fix a known session identifier in a victim&#39;s browser (for example through a network man-in-the-middle position, or a separate cross-site scripting or subdomain cookie-injection issue) could then gain access to the victim&#39;s authenticated session. The issue is fixed in v0.10.0. The session identifier is now regenerated on successful authentication, and the previous session is destroyed. There is no configuration-level workaround.</p> <p><strong>Affected:</strong> tirrenotechnologies tirreno</p> <p>tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user&#39;s credentials and establishes the authenticated session, but it does not call `session_regenerate_id()` afterward. As a result, the session identifier is not rotated on login, it stays the same before and after authentication. An attacker able to fix a known session identifier in a victim&#39;s browser (for example through a network man-in-the-middle position, or a separate cross-site scripting or subdomain cookie-injection issue) could then gain access to the victim&#39;s authenticated session. The issue is fixed in v0.10.0. The session identifier is now regenerated on successful authentication, and the previous session is destroyed. There is no configuration-level workaround.</p> https://vulnerability.circl.lu/vuln/cve-2026-64857