SB2026110378 - Session Fixation in October CMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110378

SB2026110378 - Session Fixation in October CMS

Published: November 3, 2026

Security Bulletin ID SB2026110378
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Session Fixation (CVE-ID: N/A)

CWE-ID: CWE-384 - Session Fixation

CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to inherit a victim's authenticated backend session and permissions.

The vulnerability exists due to failure to regenerate the session ID in the October Rain authentication library when a backend user logs in. A remote privileged user can plant a chosen october_session cookie in a victim's browser, induce login to a known backend URL, and reuse the unchanged session ID to access the victim's authenticated session.

Cookie placement requires either sibling-subdomain cookie tossing with a session cookie scoped to a shared parent domain or a separate cross-site scripting vulnerability on the same host.


Remediation

Install update from vendor's website.

References