Session Fixation

🗓️ 08 Jun 2026 00:00:00Reported by Snyk Security DatabaseType

Spring Web session fixation bug lets attackers with subdomain control reuse a known session ID.

Reporter	Title	Published	Views	Family All 79
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework [CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854]	27 Jul 202620:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Cross-site Scripting attacks, Denial of Service (DoS) attacks, and Server-Side Request Forgery attacks	26 Jun 202618:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.	21 Jul 202605:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for July 2026 - Multiple CVEs addressed	10 Aug 202606:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by multiple Spring Framework vulnerabilities that could allow exploiting WebSocket sessions and cross-site scripting	26 Jun 202618:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:33	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 1.0)	8 Sep 202615:03	–	ibm
Chainguard	CVE-2026-41839 vulnerabilities	6 Aug 202620:28	–	cgr
CNNVD	Spring Framework 授权问题漏洞	9 Jun 202600:00	–	cnnvd
CVE	CVE-2026-41839	9 Jun 202603:49	–	cve

Source	Link
cwe	www.cwe.mitre.org/data/definitions/CWE-384.html
cwe	www.cwe.mitre.org/data/definitions/CWE-79.html
security	www.security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128

08 Jun 2026 00:00Current

7.1High risk

Vulners AI Score7.1

CVSS 45.9

CVSS 3.14.2 - 6.5

EPSS0.00213

SSVC