CVE-2026-71302
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover.
- Published Sep 29, 2026
- CVSS 7.5 high
- 0.3% chance of exploitation in the next 30 days (EPSS)
Affected software
In the news
- Toptech TMS7 and TopHAT CISA ·