CVE-2026-40082: Cacti: Session Fixation via missing session_regenerate_id() after login
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing sessionregenerateid() after login, leading to Session Fixation. sessionregenerateid() is NOT called after successful login. The login flow at authlogin.php:203-207 directly sets $SESSION[SESSUSERID] without rotating the session ID. The session cookie configuration is otherwise good (httponly=true, samesite=Strict, secure=true for HTTPS at include/global.php:513-537), but these do not prevent session fixation via same-site vectors. This issue has been fixed in version 1.2.31.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cactito a version that resolves this vulnerability.Fixed in 1.2.31 - Configuration
Modify the login flow (auth_login.php:203-207) so that session_regenerate_id() is invoked after successfully authenticating and before setting $_SESSION[SESS_USER_ID], addressing the missing session_regenerate_id() in versions 1.2.30 and prior.
Cacti auth_login.php session_regenerate_id() = called after successful login
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40082?
CVE-2026-40082 has a severity rating of medium with a score of 5.4.
How do I fix CVE-2026-40082?
To fix CVE-2026-40082, update to Cacti version 1.2.31 or later that implements session_regenerate_id() after login.
What causes CVE-2026-40082?
CVE-2026-40082 is caused by a missing call to session_regenerate_id() after a successful login, leading to session fixation vulnerabilities.
Which versions of Cacti are affected by CVE-2026-40082?
CVE-2026-40082 affects Cacti versions 1.2.30 and earlier.
What type of vulnerability is CVE-2026-40082?
CVE-2026-40082 is categorized as a session fixation vulnerability.