CVE-2026-79312

MEDIUMCVSS 6.8

Description

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session from the store, and _save() writes back under the same session_id; no rotation after authentication, so a fixed session_id keeps the authenticated state.

Timeline

Published:September 22nd, 2026 4:17 PM

Last modified:September 22nd, 2026 8:00 PM

CVSS Scoring

CVSS v3: 6.8 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-384

References & Reports

Advisories, patches, and third-party reports

https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79312.md
https://github.com/webpy/webpy

Source: NIST NVD · Data may lag official sources by up to one minute