CVE-2026-82697: sambitraj Student-Management-System session_start cookie httponly flag
A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the function sessionstart. Such manipulation leads to cookie without 'httponly' flag. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of sambitraj/Student-Management-System containing commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are potentially affected. Because the project uses a rolling release model, affected and fixed version numbers are not available.
What does an attacker need to exploit it?
The attack can be launched remotely without privileges or user interaction, but exploitation is assessed as high complexity and difficult. A public exploit has been disclosed.
What is the impact if exploitation succeeds?
The session cookie is issued without the HttpOnly flag, which can expose it to access by client-side scripts. The reported impact is limited to confidentiality; integrity and availability impacts are not reported.
How can I determine whether my deployment is affected?
Inspect cookies created by the application's session_start handling and verify whether the HttpOnly attribute is present. Also compare the deployed source state with commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5, while accounting for the rolling-release development model.