CVE-2026-85238

MISP contains a session fixation vulnerability in its CustomAuth authentication flow (a custom configuration). The root cause is that __customAuthentication() wrote the authenticated user into the existing CakePHP session without first calling Session->renew(), which had been disabled. An atta...

EUVD-2026-70532

MISP contains a session fixation vulnerability in the CustomAuth authentication a custom configuration flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resul...

CVE-2026-85238 Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking

MISP contains a session fixation vulnerability in the CustomAuth authentication a custom configuration flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resul...

CVE-2026-85238 Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking

MISP contains a session fixation vulnerability in the CustomAuth authentication a custom configuration flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resul...

CVE-2026-85238 Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking

MISP contains a session fixation vulnerability in the CustomAuth authentication a custom configuration flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resul...

CVE-2026-85238: Session Fixation

MISP contains a session fixation vulnerability in the CustomAuth authentication a custom configuration flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resul...

PT-2026-85082

MISP contains a session fixation vulnerability in the CustomAuth authentication a custom configuration flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resul...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

EUVD-2026-70118

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

CVE-2026-84652

In Jenkins versions 2.579 and earlier (including LTS 2.568.2 and earlier ), a vulnerability exists where the application fails to rotate the session when a user authenticates using the "remember me" cookie. An attacker capable of serving content on the same site as Jenkins can set a known session...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

PT-2026-84775

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.580 Jenkins LTS versions prior to 2.568.3 Description Jenkins fails to rotate the session when a user authenticates using the "remember me" cookie. This allows an attacker capable of serving content on the same site...

CVE-2026-84652: Session Fixation

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

jenkins -- multiple vulnerabilities

Jenkins Security Advisory 2026-09-02: High SECURITY-3972 / CVE-2026-84645: Deserialization vulnerability Medium SECURITY-3908 / CVE-2026-84646: Lack of type restriction in deserialization High SECURITY-3915 / CVE-2026-84647: Instantiation of any types related to configuration High SECURITY-3967 /...

Session fixation vulnerability

Jenkins's "Keep me signed in" feature uses a persistent cookie, known as the "remember me" cookie, to re-authenticate users without requiring them to enter credentials again. In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated vi...

MGASA-2026-0351 Updated perl-Catalyst-Plugin-Authentication packages fix a security vulnerability

Catalyst::Plugin::Authentication versions before 0.10027 for Perl are susceptible to session fixation attacks. CVE-2009-10007...

Updated perl-Catalyst-Plugin-Authentication packages fix a security vulnerability

Catalyst::Plugin::Authentication versions before 0.10027 for Perl are susceptible to session fixation attacks. CVE-2009-10007...