CVE-2022-27305High· 8.8▾ TwilightGibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.9%
0.9% → 0.9%
Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.
gibbon < 23.0.02Upgrade past the affected range:
gibbon 23.0.02Connected by shared product, vendor, weakness, or advisory.
CVE-2026-97864Medium· 5.3A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01
CVE-2024-23679Critical· 9.8Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue
CVE-2016-8638Critical· 9.1Session Fixation in ipsilon
CVE-2026-115910Medium· 6.8Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the …
CVE-2026-49410High· 8.1OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation
CVE-2026-55682High· 8.1WeGIA is a web manager for charitable institutions