CVE-2026-92984: HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier
HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted link containing it, and replay the identifier after the victim authenticates to hijack their account and access.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to session hijacking through this issue?
Users who authenticate after following an attacker-supplied link containing a session identifier are exposed. The attacker can replay that identifier after the victim logs in to access the victim's account.
What must an attacker do to exploit it?
The attacker needs to obtain a valid session identifier and persuade a victim to use a crafted link that supplies that identifier in the query string or request variables. No prior authentication is required for the attacker, but victim interaction is required.
Are cookie-only session deployments affected?
The affected behavior is acceptance of session identifiers from query strings and request variables rather than cookies alone. A deployment that accepts identifiers through those inputs is affected; the provided data does not establish whether any particular configuration is cookie-only by default.
How can I check whether an instance is vulnerable?
Review the session-management code and configuration to determine whether it accepts a session identifier from URL query parameters or other request variables. The issue is reported to affect HUBzero CMS through version 2.2.32.