CVE-2026-25101CWE-384

Session Fixation in Bludit

Medium · published March 27, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enables an attacker to fix a session ID

for a victim and later hijack the authenticated session.

This issue was fixed in version 3.17.2.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00356 · 28.1th percentile
Weakness
CWE-384 · Session Fixation
Published
2026-03-27T11:55Z
EPSS history
Timeline
  • 27 MAR 11:55Z
    Session Fixation in Bludit
    cvelistv5