CVE-2025-69602

A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier after successful authentication. As a result, the same session cookie value is reused for users logging in from the same browser, allowing an attacker who can set or predict a session ID to potentially hijack an authenticated session.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/Waqar-Arain/c8117308325a91b8f3b7829646915275	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:altumcode:66biolinks:62.0.0:*:*:*:*:*:*:*

History

17 Jun 2026, 10:00

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de fijación de sesión existe en 66biolinks v62.0.0 de AltumCode, donde la aplicación no regenera el identificador de sesión después de una autenticación exitosa. Como resultado, el mismo valor de cookie de sesión se reutiliza para los usuarios que inician sesión desde el mismo navegador, permitiendo a un atacante que puede establecer o predecir un ID de sesión potencialmente secuestrar una sesión autenticada.

09 Feb 2026, 17:24

Type	Values Removed	Values Added
First Time		Altumcode Altumcode 66biolinks
References	~~() https://gist.github.com/Waqar-Arain/c8117308325a91b8f3b7829646915275 -~~	() https://gist.github.com/Waqar-Arain/c8117308325a91b8f3b7829646915275 - Exploit, Third Party Advisory
CPE		cpe:2.3:a:altumcode:66biolinks:62.0.0:::::::*

29 Jan 2026, 20:16

Type	Values Removed	Values Added
CWE		CWE-384
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.1

28 Jan 2026, 19:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-28 19:16

Updated : 2026-06-17 10:00

NVD link : CVE-2025-69602

Mitre link : CVE-2025-69602

CVE.ORG link : CVE-2025-69602

JSON object : View

Products Affected

altumcode

66biolinks

CWE

CWE-384

Session Fixation

{"id": "CVE-2025-69602", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-69602", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-29T20:04:33.645421Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-01-28T19:16:24.017", "references": [{"url": "https://gist.github.com/Waqar-Arain/c8117308325a91b8f3b7829646915275", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-384"}]}], "descriptions": [{"lang": "en", "value": "A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier after successful authentication. As a result, the same session cookie value is reused for users logging in from the same browser, allowing an attacker who can set or predict a session ID to potentially hijack an authenticated session."}, {"lang": "es", "value": "Una vulnerabilidad de fijaci\u00f3n de sesi\u00f3n existe en 66biolinks v62.0.0 de AltumCode, donde la aplicaci\u00f3n no regenera el identificador de sesi\u00f3n despu\u00e9s de una autenticaci\u00f3n exitosa. Como resultado, el mismo valor de cookie de sesi\u00f3n se reutiliza para los usuarios que inician sesi\u00f3n desde el mismo navegador, permitiendo a un atacante que puede establecer o predecir un ID de sesi\u00f3n potencialmente secuestrar una sesi\u00f3n autenticada."}], "lastModified": "2026-06-17T10:00:45.427", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:altumcode:66biolinks:62.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DE8E70F-E370-40E7-972E-461E17C2F91C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}