Cacti up to 1.2.30 auth_login.php session_regenerate_id SESS_USER_ID session fixiation

Summaryinfo

A vulnerability labeled as critical has been found in Cacti up to 1.2.30. Affected is the function session_regenerate_id of the file auth_login.php. The manipulation of the argument SESS_USER_ID results in session fixiation. This vulnerability is identified as CVE-2026-40082. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in Cacti up to 1.2.30. Affected is the function session_regenerate_id of the file auth_login.php. The manipulation of the argument SESS_USER_ID with an unknown input leads to a session fixiation vulnerability. CWE is classifying the issue as CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session_regenerate_id() after login, leading to Session Fixation. session_regenerate_id() is NOT called after successful login. The login flow at auth_login.php:203-207 directly sets $_SESSION[SESS_USER_ID] without rotating the session ID. The session cookie configuration is otherwise good (httponly=true, samesite=Strict, secure=true for HTTPS at include/global.php:513-537), but these do not prevent session fixation via same-site vectors. This issue has been fixed in version 1.2.31.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-40082 since 04/09/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

By approaching the search of inurl:auth_login.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.2.31 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 2fa404e70a5702be10682555911228e8e51ba198 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Log Management Software

Name

• Cacti

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 1.2.10
• 1.2.11
• 1.2.12
• 1.2.13
• 1.2.14
• 1.2.15
• 1.2.16
• 1.2.17
• 1.2.18
• 1.2.19
• 1.2.20
• 1.2.21
• 1.2.22
• 1.2.23
• 1.2.24
• 1.2.25
• 1.2.26
• 1.2.27
• 1.2.28
• 1.2.29
• 1.2.30

License

• open-source

Website

• Product: https://github.com/Cacti/cacti/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion