PT-2026-96773

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session. load reads session id directly from the request cookie and loads that session from the store, and save writes back under the same session id; no rotation after authentication, so a fixed session id keeps the authenticated...