CVE-2026-92984CWE-384

CVE-2026-92984

High · published September 17, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
39.2
In the wild
Unconfirmed
What it is

HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted link containing it, and replay the identifier after the victim authenticates to hijack their account and access.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
8.5 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00464 · 39.2th percentile
Weakness
CWE-384 · Session Fixation
Published
2026-09-17T19:17Z
References (4)
https://github.com/hubzero/hubzero-cms · [email protected]https://github.com/hubzero/hubzero-cms/blob/v2.2.32/core/libraries/Hubzero/Session/Manager.php#L123-L132 · [email protected]https://github.com/hubzero/hubzero-cms/commit/e60e8ebee5e1d38b1db1fc41bd9164b265b24356 · [email protected]https://www.vulncheck.com/advisories/hubzero-cms-through-2.2.32-session-fixation-via-query-string-session-identifier · [email protected]
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 14:22Z
    HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier
    cvelistv5