CVE-2026-64857: tirreno has Session Fixation in Login Authentication
tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid() afterward. As a result, the session identifier is not rotated on login, it stays the same before and after authentication. An attacker able to fix a known session identifier in a victim's browser (for example through a network man-in-the-middle position, or a separate cross-site scripting or subdomain cookie-injection issue) could then gain access to the victim's authenticated session. The issue is fixed in v0.10.0. The session identifier is now regenerated on successful authentication, and the previous session is destroyed. There is no configuration-level workaround.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tirrenoto a version that resolves this vulnerability.Fixed in 0.10.0 - Operational
After upgrading to v0.10.0, ensure authenticated users complete a new login so that the session identifier is regenerated and the previous session is destroyed.
Event History
Frequently Asked Questions
What conditions are required for an attacker to exploit this issue?
The attacker must first cause the victim's browser to use a session identifier known to the attacker. The advisory gives examples of a network man-in-the-middle position, a separate cross-site scripting issue, or a subdomain cookie-injection issue as ways to do this.
Which deployments are affected?
tirreno versions prior to 0.10.0 are affected. The issue is in the authentication flow, where the session ID was not regenerated after successful login.
Is there a workaround if upgrading is not immediately possible?
No configuration-level workaround is available. Upgrading to v0.10.0 applies the fix, which regenerates the session identifier on successful authentication and destroys the prior session.