CVE-2026-101268 Customer session fixation

If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is availab...

CVE-2026-101268 Customer session fixation

If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is availab...

CVE-2026-71302: Session Fixation

The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover...

CVE-2026-101268: Session Fixation

If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is availab...

BIT-AIRFLOW-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-92609

A flaw was found in Apache Qpid Broker-J. The application does not renew session identifiers upon successful authentication, leading to a session fixation vulnerability in the HTTP management interface. A remote attacker can exploit this issue by establishing a session identifier prior to login a...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation through the reuse of a session identifier retained across successful authentication. An attacker can gain unauthorized access to an authenticated management session by exploiting the lack of HTTP session renewal after...

CVE-2026-92609

Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...

EUVD-2026-86581

Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...

CVE-2026-92609

Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...

CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication

Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...

CVE-2026-92609

Apache Qpid Broker-J versions through 10.1.0 are vulnerable to a session fixation flaw in the HTTP management authentication. The root cause is the missing renewal of HTTP sessions after a successful authentication, which allows a remote attacker to reuse a session identifier to gain unauthorized...

CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication

Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...

CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication

Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...

CVE-2026-92609: Session Fixation

Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...

PT-2026-98391

Name of the Vulnerable Software and Affected Versions Apache Qpid Broker-J versions prior to 10.1.1 Description Session fixation in the HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session. This occurs because the system reuses ...

Session Fixation

Overview social-auth-core is a package that makes Python social authentication simple. Affected versions of this package are vulnerable to Session Fixation via the partial pipeline resume mechanism in socialcore/utils.py and socialcore/actions.py. An attacker can resume another user's partial...

social-auth-core has a Session Fixation issue

Impact The partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and...

GHSA-VQG6-3FW6-J9JG social-auth-core has a Session Fixation issue

Impact The partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and...

CVE-2026-57179

A flaw was found in social-auth-core. The partial-pipeline resume mechanism processes partial authentication tokens without binding them to the originating browser session. A remote attacker can exploit this vulnerability by initiating an authentication flow to obtain a token and inducing a victi...