CVE-2026-79312: Medium severity webpy web.py vulnerability
webpy web.py 0.76 is vulnerable to Session Fixation. The component Session.load() reads sessionid directly from the request cookie and loads that session from the store, and save() writes back under the same sessionid; no rotation after authentication, so a fixed sessionid keeps the authenticated state.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must cause a victim to use a session ID chosen by the attacker. If the victim later authenticates while using that fixed ID, the same session ID retains the authenticated state.
Which deployments are affected?
Deployments using webpy web.py 0.76 are affected where session IDs are accepted from request cookies and authentication occurs without rotating the session ID. The described behavior is in Session._load() and _save().
What can be done if an update is not immediately available?
Ensure the application generates and assigns a new session ID when authentication succeeds, and invalidate the pre-authentication session ID. This prevents an attacker-fixed ID from retaining the authenticated session state.
How can I determine whether my application is exposed?
Review the authentication flow and verify whether the session cookie value changes after a successful login. An application is exposed if a session ID supplied before authentication remains unchanged and becomes associated with the authenticated user.