CVE-2009-10007
Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can use this to impersonate the victim.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS probability
- 0.37%
- CWE
- CWE-384
- Published
- 2026-06-09
- Last modified
- 2026-06-09
Affected products
- ETHER Catalyst::Plugin::Authentication
Weakness type
Related vulnerabilities
- CVE-2026-64857 — tirreno has Session Fixation in Login Authentication
- CVE-2026-86674 — ningzichun Student Management System login.php session_start session fixiation
- CVE-2026-76196 — Photoshop Mobile | Session Fixation (CWE-384)
- CVE-2026-86279 — SourceCodester Syllabus-Aligned Learning Management & Examination System Login auth_process.php session fixiation
- CVE-2026-85238 — Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
- CVE-2026-18527 — IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].
- CVE-2026-81826 — Flowintel Fails to Invalidate Active Sessions After Password Change
- CVE-2026-70594 — Ghost: Session Fixation in Ghost Admin