CVE-2025-69602: Critical severity AltumCode 66biolinks vulnerability
A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier after successful authentication. As a result, the same session cookie value is reused for users logging in from the same browser, allowing an attacker who can set or predict a session ID to potentially hijack an authenticated session.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of AltumCode 66biolinks v62.0.0 are affected when users authenticate through a browser and the application reuses the existing session cookie rather than issuing a new session identifier after login.
What does an attacker need to exploit it?
An attacker needs the ability to set or predict a victim's session ID before the victim authenticates. If the application retains that identifier after login, the attacker may be able to use the same session to hijack the authenticated account.
Does exploitation require an existing account or user interaction?
The supplied CVSS vector indicates no privileges and no user interaction are required for the attacker. However, the described attack depends on a victim logging in with a session identifier that the attacker can set or predict.