Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2026-79312: web.py 0.76 lets attackers keep a fixed session
CVE-2026-79312 · published 1 month ago
Summary
The web.py version 0.76 web framework does not change the session identifier after a user logs in. Because the same session ID is reused, an attacker who knows or sets that ID can stay logged in as the victim. Update to a newer version or add a process that generates a new session ID after authentication.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | webpy | All versions |
Original advisory text
webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session from the store, and _save() writes back u...
webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session from the store, and _save() writes back under the same session_id; no rotation after authentication, so a fixed session_id keeps the authenticated state.
References
- https://github.com/webpy/webpy Third Party Advisory
- https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79312.md Third Party Advisory
- https://ubuntu.com/security/CVE-2026-79312 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-79312 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
6.8
Medium
Type
CWE-384Session Fixation
Timeline
Published22 Sep 2026
Updated3 Nov 2026
First seen22 Sep 2026
Track software like this
Free during beta