Session Fixation in October CMS - #VU158941
Published: November 3, 2026
Vulnerability identifier: #VU158941
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-384
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to inherit a victim's authenticated backend session and permissions.
The vulnerability exists due to failure to regenerate the session ID in the October Rain authentication library when a backend user logs in. A remote privileged user can plant a chosen october_session cookie in a victim's browser, induce login to a known backend URL, and reuse the unchanged session ID to access the victim's authenticated session.
Cookie placement requires either sibling-subdomain cookie tossing with a session cookie scoped to a shared parent domain or a separate cross-site scripting vulnerability on the same host.
Affected software
October CMS
Remediation
Install security update from vendor's website.
October CMS - update to 4.3.4