CVE-2026-79312

n/a / n/a PUBLISHED

Description (CNA)

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session from the store, and _save() writes back under the same session_id; no rotation after authentication, so a fixed session_id keeps the authenticated state.

Affected (CNA)

Vendor / product	Versions
n/a / n/a	affected n/a

CWE

No CWE identifiers supplied.

References

https://github.com/webpy/webpy
https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79312.md

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.