CVE-2023-52268: Session Fixation (CVSS 9.1)

Description

The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint. NOTE: this module is not part of freescout-helpdesk/freescout on GitHub.

Is your site exposed to CVE-2023-52268?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness Type (CWE)

CWE-384 CWE-384

References

Other References

https://freescout.net/module/end-user-portal/ https://freescout.net/modules-faq/ https://github.com/squ1dw3rm/CVE-2023-52268

Frequently Asked Questions

What is CVE-2023-52268? +

The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint. NOTE: this module is not part of freescout-helpdesk/freescout on GitHub. It has a CVSS v3.1 base score of 9.1 (CRITICAL).

How severe is CVE-2023-52268? +

CVE-2023-52268 has a CVSS v3.1 score of 9.1 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

How do I check if I'm vulnerable to CVE-2023-52268? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-24502

An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of …

CVE-2025-24503

A malicious actor can fix the session of a PAM user by tricking the user to click on a specially …

CVE-2025-4644

A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could …

CVE-2026-86688

Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to …

CVE-2026-64857

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's …

CVE-2026-33384

QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same …

CVE-2023-52268