MEDIUM 6.8 NVD
CVE-2026-79312
webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session from
webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session from the store, and _save() writes back under the same session_id; no rotation after authentication, so a fixed session_id keeps the authenticated state.
References
- https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79312.md
- https://github.com/webpy/webpy
This medium severity vulnerability with a CVSS score of 6.8 was published on 2026-09-22 via NVD.
vulnfeed aggregates 14151 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.