CVE-2026-104469

MEDIUM CVSS 6.8 View on NVD ↗

Description

YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID. Attackers who set or learn a victim's pre-authentication YesWiki-* session cookie can reuse it after login to access private content and perform actions with the victim's privileges.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-7fvc-v2hp-5pwh
https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-session-fixation-via-login-in-authcontroller-php

Published: Oct 02, 2026 12:17 UTC Modified: Oct 02, 2026 12:17 UTC