CVE-2026-79312
MediumCVSS 6.8Summary
webpy web.py 0.76 is vulnerable to Session Fixation. The Session._load() component reads session_id directly from the request cookie and loads that session from the store, and _save() writes back under the same session_id; there is no rotation after authentication, so a fixed session_id keeps the authenticated state.
Risk Assessment
An attacker can fix a victim's session ID and after the victim logs in, hijack the session to access protected resources. The risk is high in applications using web.py for authentication.
Recommendation
Update web.py to a version containing the fix or implement session ID rotation after successful authentication. Consider using an alternative framework if no fix is available.
Other vulnerabilities in web.py
See all- CVE-2026-79311Unknown
webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().
- CVE-2026-79313Unknown
webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. As a result, an expired session whose record has not yet been cleaned up can still be replayed and used, allowing an attacker holding a previously valid session cookie to continue accessing protected resources after the configured idle timeout.
Original NVD description (English source)
webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session from the store, and _save() writes back under the same session_id; no rotation after authentication, so a fixed session_id keeps the authenticated state.