CVE-2026-55682: WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DBHOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute, and the vulnerable session handler affects all PHP pages. This issue is fixed in version 3.8.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.8.6
Event History
Frequently Asked Questions
Which deployments are affected?
WeGIA deployments running versions prior to 3.8.6 are affected. The vulnerable session handler is auto-prepended and affects all PHP pages.
What must an attacker do to hijack a session?
An attacker must cause a victim to use an attacker-selected PHPSESSID value and then authenticate while that identifier is active. The attacker can subsequently reuse that identifier to access the authenticated session.
Are unauthenticated users exposed?
Yes. The issue requires no attacker privileges, although it requires victim interaction because the victim must authenticate using the attacker-selected session identifier.
What information is disclosed besides the session risk?
The response exposes the internal database host name because DB_HOST is used as the cookie Domain attribute.
What is the available remediation?
Upgrade WeGIA to version 3.8.6, which fixes the issue.