CVE-2026-25101

4.8 mediumEPSS 0.4%

Medium (4.8) in bludit bludit. EPSS 0.4% chance of exploitation in the next 30 days.

Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enables an attacker to fix a session ID for a victim and later hijack the authenticated session. This issue was fixed in version 3.17.2.

Severity

CVSS 4.0

4.8 medium

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWE: CWE-384
Published: 2026-03-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

bludit:bludit

References

https://cert.pl/posts/2026/03/CVE-2026-25099
https://github.com/bludit/bludit/releases/tag/3.17.2

Check your stack JSON