CVE-2026-64857: Session Fixation

Description

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call `session_regenerate_id()` afterward. As a result, the session identifier is not rotated on login, it stays the same before and after authentication. An attacker able to fix a known session identifier in a victim's browser (for example through a network man-in-the-middle position, or a separate cross-site scripting or subdomain cookie-injection issue) could then gain access to the victim's authenticated session. The issue is fixed in v0.10.0. The session identifier is now regenerated on successful authentication, and the previous session is destroyed. There is no configuration-level workaround.

Is your site exposed to CVE-2026-64857?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0027

Probability of exploitation

0.19%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-384 CWE-384

References

Other References

https://github.com/tirrenotechnologies/tirreno/releases/tag/v0.10.0 https://github.com/tirrenotechnologies/tirreno/security/advisories/GHSA-gwcm-4p9m-9mvr

Frequently Asked Questions

What is CVE-2026-64857? +

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call `session_regenerate_id()` afterward. As a result, the session identifier is not rotated on login, it stays the same before and after authentication. An attacker able to fix a known session identifier in a victim's browser (for example through a network man-in-the-middle position, or a separate cross-site scripting or subdomain cookie-injection issue) could then gain access to the victim's authenticated session. The issue is fixed in v0.10.0. The session identifier is now regenerated on successful authentication, and the previous session is destroyed. There is no configuration-level workaround.

How do I check if I'm vulnerable to CVE-2026-64857? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-81826

Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if …

CVE-2025-24503

A malicious actor can fix the session of a PAM user by tricking the user to click on a specially …

CVE-2026-86688

Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to …

CVE-2026-33384

QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same …

CVE-2025-24502

An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of …

CVE-2025-42602

This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API endpoints …

CVE-2026-64857