CVE-2026-79312 in webpy
Summary
by MITRE • 09/22/2026
webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session from the store, and _save() writes back under the same session_id; no rotation after authentication, so a fixed session_id keeps the authenticated state.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in web.py version 0.76 represents a critical Session Fixation flaw within its core session management component. This issue stems from an insecure implementation of how the framework handles user sessions during the authentication lifecycle. Specifically, the internal methods _load() and _save() are designed to read the session identifier directly from the incoming request cookie without performing any validation or regeneration checks prior to binding it to a new authenticated state. When a client presents a specific session ID in their cookies, the application accepts this identifier as valid and proceeds to load the associated session data from its storage backend. Upon successful authentication, instead of issuing a fresh, cryptographically random session token that severs the link between the pre-authentication context and the post-authentication privileges, web.py retains the original session ID provided by the client. This behavior allows an attacker who has previously established or guessed a valid session identifier to maintain control over that specific session even after the victim user logs in with elevated permissions.
From a technical perspective, this flaw violates fundamental security principles regarding state management and identity verification. The absence of session rotation upon authentication is the primary mechanism enabling exploitation. In secure web applications, it is standard practice to generate a new session identifier immediately following successful login or privilege escalation. This process ensures that any session data associated with an unauthenticated or lower-privilege context cannot be hijacked by an attacker who may have been tracking or injecting a specific session ID into the victim's browser via cross-site scripting, phishing, or other injection vectors. By failing to rotate the session identifier, web.py effectively allows an adversary to anchor themselves to a persistent identity that gains full access once authentication succeeds. This creates a direct pathway for unauthorized access where the attacker does not need to crack passwords but merely needs to ensure their chosen session ID is present in the victim's cookie jar at the time of login.
The operational impact of this vulnerability is severe, as it facilitates complete account takeover without requiring password compromise or complex exploitation techniques beyond initial contact with the application. An attacker can initiate a connection to the web.py-based service and receive a predictable or arbitrary session ID from the server. This identifier can then be delivered to the target user through various social engineering tactics such as malicious links in emails, compromised websites via stored cross-site scripting, or even simple URL manipulation if the framework allows GET parameters for sessions. Once the victim authenticates using their credentials while this injected cookie is active, the application binds the attacker's chosen session ID to the now-authenticated account. The attacker can subsequently use this fixed session identifier to access all resources and data associated with that user profile, effectively impersonating them within the system. This undermines the integrity of the authentication mechanism entirely, rendering credential-based security controls ineffective against passive observers or active injectors who control the client-side context.
To mitigate this vulnerability, immediate remediation is required at both the framework level and the application development layer. For users relying on web.py 0.76, upgrading to a patched version of the library that implements proper session rotation upon authentication is essential. If an upgrade is not immediately feasible, developers must implement custom middleware or wrapper functions around the session handling logic. This custom code should explicitly detect successful authentication events and trigger the generation of a new, random session identifier while migrating any necessary non-sensitive data from the old session to the new one. Additionally, applications should enforce strict cookie attributes such as HttpOnly to mitigate cross-site scripting risks that facilitate initial injection, Secure flags to prevent transmission over unencrypted channels, and SameSite policies to restrict how cookies are sent with cross-origin requests. Regular security audits focusing on state management patterns and adherence to industry standards like CWE-384 (Session Fixation) and MITRE ATT&CK techniques related to Session Hijacking will help ensure that such flaws do not persist in production environments.