high7.1
CVE-2026-71302
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication.
Impact
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.