CWE-488
AllowedExposure of Data Element to Wrong Session
Abstraction: Base · Status: Draft
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
66 vulnerabilities reference this CWE, most recent first.
GHSA-H55G-WW3M-9HQ9
Vulnerability from github – Published: 2026-03-24 21:31 – Updated: 2026-03-24 21:31For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information in Zabbix documentation.
{
"affected": [],
"aliases": [
"CVE-2026-23919"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-24T19:16:49Z",
"severity": "HIGH"
},
"details": "For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information \u003ca href=\u0027https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe\u0027\u003ein Zabbix documentation\u003c/a\u003e.",
"id": "GHSA-h55g-ww3m-9hq9",
"modified": "2026-03-24T21:31:23Z",
"published": "2026-03-24T21:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23919"
},
{
"type": "WEB",
"url": "https://support.zabbix.com/browse/ZBX-27638"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-HM8W-PXCF-MJ62
Vulnerability from github – Published: 2023-05-10 15:30 – Updated: 2024-04-04 03:59Exposure of data element to wrong session in the Intel DCM software before version 5.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2022-40210"
],
"database_specific": {
"cwe_ids": [
"CWE-488",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-10T14:15:14Z",
"severity": "HIGH"
},
"details": "Exposure of data element to wrong session in the Intel DCM software before version 5.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.",
"id": "GHSA-hm8w-pxcf-mj62",
"modified": "2024-04-04T03:59:29Z",
"published": "2023-05-10T15:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40210"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00772.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-MFVP-7P3V-X9MH
Vulnerability from github – Published: 2026-05-28 18:30 – Updated: 2026-07-02 18:37In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest previously issued by Casdoor. Additionally, if an administrator disables or deletes an IdP (Identity Provider) after a SAML flow has started, the handler still processes the response using the provider snapshot loaded at the start of the request. As a result, an attacker controlling a registered upstream IdP can send unsolicited SAML responses, or replay a legitimately captured response in a different session or after the original flow has ended. In both cases, Casdoor accepts the response and issues a session, enabling persistent unauthorized access.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/casdoor/casdoor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1000.1-0.20260321120606-239e8bd69487"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-9098"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-02T18:37:59Z",
"nvd_published_at": "2026-05-28T17:16:34Z",
"severity": "CRITICAL"
},
"details": "In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest previously issued by Casdoor. Additionally, if an administrator disables or deletes an IdP (Identity Provider) after a SAML flow has started, the handler still processes the response using the provider snapshot loaded at the start of the request. As a result, an attacker controlling a registered upstream IdP can send unsolicited SAML responses, or replay a legitimately captured response in a different session or after the original flow has ended. In both cases, Casdoor accepts the response and issues a session, enabling persistent unauthorized access.",
"id": "GHSA-mfvp-7p3v-x9mh",
"modified": "2026-07-02T18:37:59Z",
"published": "2026-05-28T18:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9098"
},
{
"type": "PACKAGE",
"url": "https://github.com/casdoor/casdoor"
},
{
"type": "WEB",
"url": "https://kb.cert.org/vuls/id/780781"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest"
}
GHSA-P4RQ-VWGG-386F
Vulnerability from github – Published: 2024-02-08 12:30 – Updated: 2026-05-20 12:30Exposure of Data Element to Wrong Session vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable.This issue affects MİA-MED: before 1.0.7.
{
"affected": [],
"aliases": [
"CVE-2023-6519"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-08T12:15:55Z",
"severity": "HIGH"
},
"details": "Exposure of Data Element to Wrong Session vulnerability in Mia Technology Inc. M\u0130A-MED allows Read Sensitive Strings Within an Executable.This issue affects M\u0130A-MED: before 1.0.7.",
"id": "GHSA-p4rq-vwgg-386f",
"modified": "2026-05-20T12:30:35Z",
"published": "2024-02-08T12:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6519"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0087"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-24-0087"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P8F6-44XP-3CP8
Vulnerability from github – Published: 2026-09-07 18:31 – Updated: 2026-09-07 18:31In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens
{
"affected": [],
"aliases": [
"CVE-2026-86492"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-07T17:17:27Z",
"severity": "HIGH"
},
"details": "In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens",
"id": "GHSA-p8f6-44xp-3cp8",
"modified": "2026-09-07T18:31:32Z",
"published": "2026-09-07T18:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86492"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PHG3-GV66-Q38X
Vulnerability from github – Published: 2025-02-13 15:31 – Updated: 2025-03-03 15:31A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-rest"
},
"ranges": [
{
"events": [
{
"introduced": "3.16.0.CR1"
},
{
"fixed": "3.18.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-rest-deployment"
},
"ranges": [
{
"events": [
{
"introduced": "3.16.0.CR1"
},
{
"fixed": "3.18.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-rest"
},
"ranges": [
{
"events": [
{
"introduced": "3.9.0.CR1"
},
{
"fixed": "3.15.3.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-rest-deployment"
},
"ranges": [
{
"events": [
{
"introduced": "3.9.0.CR1"
},
{
"fixed": "3.15.3.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-rest"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.6.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-rest-deployment"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.6.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-1247"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": true,
"github_reviewed_at": "2025-02-13T17:36:18Z",
"nvd_published_at": "2025-02-13T14:16:18Z",
"severity": "HIGH"
},
"details": "A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.",
"id": "GHSA-phg3-gv66-q38x",
"modified": "2025-03-03T15:31:24Z",
"published": "2025-02-13T15:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1247"
},
{
"type": "WEB",
"url": "https://github.com/quarkusio/quarkus/issues/45789"
},
{
"type": "WEB",
"url": "https://github.com/quarkusio/quarkus/commit/02ff9ed45c3928edf2a0f8b906543606fed7cd53"
},
{
"type": "WEB",
"url": "https://github.com/quarkusio/quarkus/commit/d8df15cec17dc5d085efc372d77cbef1341ae071"
},
{
"type": "WEB",
"url": "https://github.com/quarkusio/quarkus/commit/f42166ee7041ed09b7183d5dbf3ece2439b16676"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:1884"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:1885"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2067"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-1247"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345172"
},
{
"type": "PACKAGE",
"url": "https://github.com/quarkusio/quarkus"
},
{
"type": "WEB",
"url": "https://quarkus.io/blog/cve-fixes-feb-2025"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance"
}
GHSA-PQMH-9H5R-56PF
Vulnerability from github – Published: 2026-07-04 09:31 – Updated: 2026-07-04 09:31A vulnerability has been found in FederatedAI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.initEggroll of the file java/osx/osx-broker/src/main/java/org/fedai/osx/broker/grpc/QueuePushReqStreamObserver.java of the component OSX Broker. Such manipulation of the argument rollSiteSessionId/dstRole/dstPartyId leads to exposure of data element to wrong session. The attack can be executed remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
{
"affected": [],
"aliases": [
"CVE-2026-14621"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-04T09:16:27Z",
"severity": "LOW"
},
"details": "A vulnerability has been found in FederatedAI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.initEggroll of the file java/osx/osx-broker/src/main/java/org/fedai/osx/broker/grpc/QueuePushReqStreamObserver.java of the component OSX Broker. Such manipulation of the argument rollSiteSessionId/dstRole/dstPartyId leads to exposure of data element to wrong session. The attack can be executed remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.",
"id": "GHSA-pqmh-9h5r-56pf",
"modified": "2026-07-04T09:31:45Z",
"published": "2026-07-04T09:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14621"
},
{
"type": "WEB",
"url": "https://github.com/FederatedAI/FATE/issues/5791"
},
{
"type": "WEB",
"url": "https://github.com/FederatedAI/FATE/pull/5792"
},
{
"type": "WEB",
"url": "https://github.com/FederatedAI/FATE"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-14621"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/844900"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/376137"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/376137/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-QMVM-MG94-C39P
Vulnerability from github – Published: 2024-02-26 18:30 – Updated: 2024-08-14 18:32In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files. This is fixed in Assetwise ALIM Web 23.00.02.03 and Assetwise Information Integrity Server 23.00.04.04.
{
"affected": [],
"aliases": [
"CVE-2024-27455"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-26T16:28:00Z",
"severity": "CRITICAL"
},
"details": "In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user\u0027s ALIM session token when the user attempts to download files. This is fixed in Assetwise ALIM Web 23.00.02.03 and Assetwise Information Integrity Server 23.00.04.04.",
"id": "GHSA-qmvm-mg94-c39p",
"modified": "2024-08-14T18:32:36Z",
"published": "2024-02-26T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27455"
},
{
"type": "WEB",
"url": "https://www.bentley.com/advisories/be-2024-0001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R8J3-CWJ5-4J73
Vulnerability from github – Published: 2026-09-06 18:34 – Updated: 2026-09-08 21:33A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup
for a given hostname even when using a different Native CA Store setting
(CURLSSLOPT_NATIVE_CA) than when the connection was created.
{
"affected": [],
"aliases": [
"CVE-2026-80231"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-06T18:17:22Z",
"severity": "HIGH"
},
"details": "A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.",
"id": "GHSA-r8j3-cwj5-4j73",
"modified": "2026-09-08T21:33:03Z",
"published": "2026-09-06T18:34:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80231"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3969368"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2026-80231.html"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2026-80231.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RHW6-3RRG-MWJQ
Vulnerability from github – Published: 2026-09-06 18:34 – Updated: 2026-09-08 18:31A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
{
"affected": [],
"aliases": [
"CVE-2026-19931"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-06T18:17:20Z",
"severity": "CRITICAL"
},
"details": "A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B\u0027s request get sent over user A\u0027s\npreviously authenticated connection.",
"id": "GHSA-rhw6-3rrg-mwjq",
"modified": "2026-09-08T18:31:45Z",
"published": "2026-09-06T18:34:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19931"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3923520"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2026-19931.html"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2026-19931.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Protect the application's sessions from information leakage. Make sure that a session's data is not used or visible by other sessions.
Mitigation
Use a static analysis tool to scan the code for information leakage vulnerabilities (e.g. Singleton Member Field).
Mitigation
In a multithreading environment, storing user data in Servlet member fields introduces a data access race condition. Do not use member fields to store information in the Servlet.
CAPEC-59: Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
CAPEC-60: Reusing Session IDs (aka Session Replay)
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.