CVE-2026-25101

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-25101

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25101.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-25101

Published

2026-03-27T11:55:08.924Z

Modified

2026-07-15T01:49:19.859262632Z

Severity

4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Session Fixation in Bludit

Details

Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enables an attacker to fix a session ID for a victim and later hijack the authenticated session.

This issue was fixed in version 3.17.2.

Database specific

{
    "cna_assigner": "CERT-PL",
    "cwe_ids": [
        "CWE-384"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25101.json"
}

References

Affected packages

Git / github.com/bludit/bludit

Affected ranges

Type

GIT

Repo

https://github.com/bludit/bludit

Events

Introduced

Fixed

a0ff3dd4e78fa3f34e39ed127a7c353713718ec0

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:bludit:bludit:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.17.2"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25101.json"