CVE-2026-79312 | BDVDB-2026-377803 Detail

Description#

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session from the store, and _save() writes back under the same session_id; no rotation after authentication, so a fixed session_id keeps the authenticated state.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-22Record published in the CVE List.