CVE-2026-78428CWE-384

CVE-2026-78428

published September 17, 2026

CVSS
8.0
EPSS
0%
Percentile
17.7
In the wild
Unconfirmed
What it is

For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently

The record
Technical detail
CVSS
8.0 · NONE
CVSS v4.0
Not supplied
EPSS
0.00267 · 17.7th percentile
Weakness
CWE-384 · Session Fixation
Published
2026-09-17T14:17Z
References (2)
https://bugzilla.suse.com/show_bug.cgi?id=1279937 · [email protected]https://github.com/neuvector/neuvector/security/advisories/GHSA-c6rx-pmvf-m3jx · [email protected]
EPSS history
Timeline
  • 18 SEP 04:01Z
    EPSS moved — → 0%
    epss
  • 17 SEP 09:19Z
    Flaw in Nuevector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently
    cvelistv5