CVE-2026-33384

QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. This issue was fixed in a patch to version 6.8 published on 15.05.2026, deployments without this patch are still vulnerable.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/posts/2026/05/CVE-2026-33384/
https://opensolution.org/home.html

Configurations

No configuration.

History

21 Jul 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) QuickCMS permite que el identificador de sesión de un usuario sea establecido antes de la autenticación. El valor de este ID de sesión permanece igual después de la autenticación. Este comportamiento permite a un atacante fijar un ID de sesión para una víctima y luego secuestrar la sesión autenticada. Este problema fue solucionado en un parche para la versión 6.8 publicado el 15.05.2026, las implementaciones sin este parche siguen siendo vulnerables.

29 May 2026, 16:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-29 16:16

Updated : 2026-07-21 15:10

NVD link : CVE-2026-33384

Mitre link : CVE-2026-33384

CVE.ORG link : CVE-2026-33384

JSON object : View

Products Affected

No product.

CWE

CWE-384

Session Fixation

{"id": "CVE-2026-33384", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33384", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-29T17:31:45.627313Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "OpenSolution", "product": "QuickCMS", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.8"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-29T16:16:25.417", "references": [{"url": "https://cert.pl/posts/2026/05/CVE-2026-33384/", "source": "cvd@cert.pl"}, {"url": "https://opensolution.org/home.html", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-384"}]}], "descriptions": [{"lang": "en", "value": "QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID\nfor a victim and later hijack the authenticated session.\n\nThis issue was fixed in a patch to version 6.8 published on 15.05.2026, deployments without this patch are still vulnerable."}, {"lang": "es", "value": "QuickCMS permite que el identificador de sesi\u00f3n de un usuario sea establecido antes de la autenticaci\u00f3n. El valor de este ID de sesi\u00f3n permanece igual despu\u00e9s de la autenticaci\u00f3n. Este comportamiento permite a un atacante fijar un ID de sesi\u00f3n para una v\u00edctima y luego secuestrar la sesi\u00f3n autenticada.\n\nEste problema fue solucionado en un parche para la versi\u00f3n 6.8 publicado el 15.05.2026, las implementaciones sin este parche siguen siendo vulnerables."}], "lastModified": "2026-07-21T15:10:00.103", "sourceIdentifier": "cvd@cert.pl"}