CVE Intelligence
Analysis AI-assisted

CVE-2026-25101: Bludit Session Fixation (CWE-384)

Bludit sets the user's session identifier before authentication and keeps the same value after login, which is a session fixation weakness. The record gives a CVSS base score of 9.8 from NVD and states the issue was fixed in version 3.17.2. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-25101 describes a session fixation weakness in Bludit, a content management system. According to the record, the session identifier is set before authentication and is not renewed when the user logs in. The weakness is classified as CWE-384.

Impact

  • The record states that an attacker could fix a session identifier for a victim and later hijack the authenticated session.
  • NVD assigns a CVSS base score of 9.8, rated critical. The vector in the record marks confidentiality, integrity and availability impacts as high.
  • CERT-PL is listed with a lower CVSS score of 4.8 in the record.

Affected products and versions

  • Product: Bludit Bludit.
  • Versions before 3.17.2 are listed as affected in the record.
  • The fixed version is 3.17.2, as indicated by the release tag listed in the references.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The record gives an EPSS probability of 0.00356 and a percentile of 0.28144.
  • The SSVC fields in the record indicate exploitation none and automatable no.

Remediation and mitigation

  • Upgrade Bludit installations to version 3.17.2 or later.
  • Inventory all Bludit instances, including those not managed centrally, and prioritize internet-facing ones.
  • Where upgrading is not immediately possible, limit access to administrative and login functions to trusted networks where feasible.
  • After upgrading, consider invalidating sessions that existed before the update and requiring fresh logins.

Detection guidance

  • Review authentication logs for sessions that remain valid across a login event or that appear from unexpected client addresses or user agents.
  • Watch for account activity that follows logins from unfamiliar locations, since that pattern can indicate session misuse.

Limitations of the available information

  • The CERT-PL reference URL in the record refers to the identifier CVE-2026-25099, not CVE-2026-25101. Its content was not verified against this CVE.
  • The record does not describe the exact code path, the authentication flow, or whether default configurations are affected.
  • The record does not explain the difference between the NVD score of 9.8 and the CERT-PL score of 4.8.
  • The affected range is given only as versions before 3.17.2, with no lower boundary.

Frequently asked questions

What is the core weakness in CVE-2026-25101?

Bludit sets the session identifier before authentication and keeps the same value after the user logs in, which is classified as session fixation (CWE-384).

Which version fixes this issue?

The record states the issue was fixed in version 3.17.2 and lists the release tag 3.17.2 among its references.

Is this CVE known to be exploited in the wild?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.