CVE-2026-38968
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability in ntopng up to version 6.6 allows predictable session identifiers, leading to session hijacking. HTTP session IDs are generated using weak time-seeded pseudo-randomness, making them deterministic or collision-prone.
Risk Assessment
An attacker can hijack an authenticated administrator session, gaining unauthorized access to the ntopng management interface and potentially sensitive network data.
Recommendation
Immediately upgrade ntopng to a version newer than 6.6 that includes a fix. If upgrading is not possible, restrict access to the ntopng interface to trusted networks only.
Original NVD description (English source)
ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.