Intel

AIKIDO-2025-10512

craftcms/cms is vulnerable to Session Fixation

Session Fixation Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.

61

Medium Risk

This Affects:

phpcraftcms/cms
4.0.0 - 4.16.7
Fixed in 4.16.8
5.0.0 - 5.8.10
Fixed in 5.8.11

TL;DR

Affected versions of this package are vulnerable to potential session leakage, as requests might be processed after the user session has been established. This timing issue may allow unauthorized parties to intercept or reuse active sessions under certain conditions, increasing the risk of session hijacking or unauthorized access. Proper session handling should ensure that session establishment and validation occur before any sensitive request processing takes place.

Who does this affect?

You are affected if you are using a version which is within vulnerability ranges

Background info

craftcms/cms is vulnerable to Session Fixation in versions 4.0.0 - 4.16.7 and 5.0.0 - 5.8.10.

How to fix this

Upgrade the craftcms/cms library to a patch version.