Bludit allows user's session identifier to be set before authentication.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 27, 2026 · NIST NVD

   Detected

   Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enables an attacker to fix a session ID for a victim and later hijack the authenticated session. This issue was fixed in version 3.17.2.

2. Jun 17, 2026 · NIST NVD

   Updated

   Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enables an attacker to fix a session ID for a victim and later hijack the authenticated session. This issue was fixed in version 3.17.2.

Affected

• cpe bludit/bluditversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-25101

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-25101

  Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enables an attacker to fix a session ID for a victim and later hijack the authenticated session. This issue was fixed in versi

  nvd.nist.gov

References

• Third Party Advisory · cert.pl
• Release Notes · github.com