medium6.8
CVE-2026-104469
YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP…
Impact
YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID. Attackers who set or learn a victim's pre-authentication YesWiki-* session cookie can reuse it after login to access private content and perform actions with the victim's privileges.
Affected products
| Product | Affected versions |
|---|---|
| YesWiki | before 4.6.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.