CWE-384: Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Such a scenario is commonly observed when: A web application authenticates a user without first invalidating the existing session, thereby continuing to use the session already associated with the user. An attacker is able to force a known session identifier on a user so that, once the user authenticates, the attacker has access to the authenticated session. The application or container uses predictable session identifiers. In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user's account through the active session.

Consequences

• Access Control: Gain Privileges or Assume Identity

How to prevent it

• Architecture and Design: Invalidate any existing session identifiers prior to authorizing a new user session.
• Architecture and Design: For platforms such as ASP that do not generate new values for sessionid cookies, utilize a secondary cookie. In this approach, set a secondary cookie on the user's browser to a random value and set a session variable to the same value. If the session variable and the cookie value ever don't match, invalidate the session, and force the user to log on again.
• Operation: Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].

Recent advisories

• GHSA-p2jm-6hj6-9rjg — AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
• CVE-2026-102489 — Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user.
• PYSEC-2026-3989 — When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie…
• EEF-CVE-2026-86688 — Session id is not renewed on authentication in ash_authentication, allowing session fixation
• GHSA-7mpp-r37j-x5wh — Ghost: Session Fixation in Ghost Admin
• GHSA-5qfp-32cf-69jh — SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers
• GHSA-4hfh-6x8g-gwpp — Spring Framework Escalation via Session Fixation in WebFlux
• GHSA-7hp7-4p35-3cx2 — Gradio contains a cookie injection vulnerability
• GHSA-45m8-cpm2-3v65 — Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
• GHSA-qvqr-5cv7-wh35 — MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
• GHSA-7q7g-x6vg-xpc3 — OpenBao lacks user confirmation for OIDC direct callback mode
• GHSA-x3pr-vrhq-vq43 — AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration
• GHSA-gq2m-77hf-vwgh — OliveTin Session Fixation: Logout Fails to Invalidate Server-Side Session
• GHSA-rg35-5v25-mqvp — Keycloak vulnerable to session takeovers due to reuse of session identifiers
• GHSA-26rv-h2hf-3fw4 — Payload's SQLite adapter Session Fixation vulnerability

All advisories for CWE-384