cve.bz

CAPEC-61

Session Fixation

High severityMedium likelihoodDetailed pattern

The attacker induces a client to establish a session with the target software using a session identifier provided by the attacker. Once the user successfully authenticates to the target software, the attacker uses the (now privileged) session identifier in their own transactions. This attack leverages the fact that the target software either relies on client-generated session identifiers or maintains the same session identifiers after privilege elevation.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-61: Session Fixation: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/61.html and https://cve.bz/cve/capec/61?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Setup the Attack] Setup a session: The attacker has to setup a trap session that provides a valid session identifier, or select an arbitrary identifier, depending on the mechanism employed by the application. A trap session is a dummy session established with the application by the attacker and is used solely for the purpose of obtaining valid session identifiers. The attacker may also be required to periodically refresh the trap session in order to obtain valid session identifiers.

      2 techniques
      • The attacker chooses a predefined identifier that they know.
      • The attacker creates a trap session for the victim.

  2. Experiment

    They probe what they found.

    1. [Attract a Victim] Fixate the session: The attacker now needs to transfer the session identifier from the trap session to the victim by introducing the session identifier into the victim's browser. This is known as fixating the session. The session identifier can be introduced into the victim's browser by leveraging cross site scripting vulnerability, using META tags or setting HTTP response headers in a variety of ways.

      3 techniques
      • Attackers can put links on web sites (such as forums, blogs, or comment forms).
      • Attackers can establish rogue proxy servers for network protocols that give out the session ID and then redirect the connection to the legitimate service.
      • Attackers can email attack URLs to potential victims through spam and phishing techniques.

  3. Exploit

    They carry out the attack.

    1. [Abuse the Victim's Session] Takeover the fixated session: Once the victim has achieved a higher level of privilege, possibly by logging into the application, the attacker can now take over the session using the fixated session identifier.

      2 techniques
      • The attacker loads the predefined session ID into their browser and browses to protected data or functionality.
      • The attacker loads the predefined session ID into their software and utilizes functionality with the rights of the victim.

Prerequisites

  • Session identifiers that remain unchanged when the privilege levels change.

  • Permissive session management mechanism that accepts random user-generated session identifiers

  • Predictable session identifiers

Skills required

  • Low skill

    Only basic skills are required to determine and fixate session identifiers in a user's browser. Subsequent attacks may require greater skill levels depending on the attackers' motives.

Resources required

  • None: No specialized resources are required to execute this type of attack.

Signs of an attack

  • There are no indicators for the server since a fixated session identifier is similar to an ordinarily generated one. However, too many invalid sessions due to invalid session identifiers is a potential warning.

  • A client can be suspicious if a received link contains preset session identifiers. However, this depends on the client's knowledge of such an issue. Also, fixation through Cross Site Scripting or hidden form fields is usually difficult to detect.

Consequences

What a successful attack can lead to
ImpactAffectsNote
Gain PrivilegesConfidentiality, Access Control, Authorization

Mitigations

  • Use a strict session management mechanism that only accepts locally generated session identifiers: This prevents attackers from fixating session identifiers of their own choice.

  • Regenerate and destroy session identifiers when there is a change in the level of privilege: This ensures that even though a potential victim may have followed a link with a fixated identifier, a new one is issued when the level of privilege changes.

  • Use session identifiers that are difficult to guess or brute-force: One way for the attackers to obtain valid session identifiers is by brute-forcing or guessing them. By choosing session identifiers that are sufficiently random, brute-forcing or guessing becomes very difficult.

Weaknesses it exploits

  • CWE-384 Session Fixation
  • CWE-664 Improper Control of a Resource Through its Lifetime
  • CWE-732 Incorrect Permission Assignment for Critical Resource

Recent CVEs with these weaknesses

  1. –CVE-2026-97890

    The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authent…

  2. 9.4CVE-2026-119446

    Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_s…

  3. 3.9CVE-2026-14543

    The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-pr…

  4. 7.4CVE-2026-12963

    A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.

  5. 7.3CVE-2026-112125

    Incorrect Permission Assignment for Critical Resource Vulnerability in HA Monitor. This issue affects HA Monitor: from 01-00 before 01-83-01.

  6. 2.1CVE-2026-125078

    A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely.…

  7. 7.8CVE-2026-114031

    Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. Th…

  8. 7.4CVE-2026-123801

    SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseT…

The newest records naming one of them. Each weakness's page lists them all.

Part of

Examples

Consider a banking application that issues a session identifier in the URL to a user before login, and uses t…

Consider a banking application that issues a session identifier in the URL to a user before login, and uses the same identifier to identify the customer following successful authentication. An attacker can easily leverage session fixation to access a victim's account by having the victim click on a forged link that contains a valid session identifier from a trapped session setup by the attacker. Once the victim is authenticated, the attacker can take over the session and continue with the same levels of privilege as the victim.

An attacker can hijack user sessions, bypass authentication controls and possibly gain administrative privile…

An attacker can hijack user sessions, bypass authentication controls and possibly gain administrative privilege by fixating the session of a user authenticating to the Management Console on certain versions of Macromedia JRun 4.0. This can be achieved by setting the session identifier in the user's browser and having the user authenticate to the Management Console. Session fixation is possible since the application server does not regenerate session identifiers when there is a change in the privilege levels. See also: CVE-2004-2182

MITRE's words, unchanged: CAPEC-61 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.