CVE-2026-79312

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-22 · updated 2026-09-22
Weakness: CWE-384

Description

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session from the store, and _save() writes back under the same session_id; no rotation after authentication, so a fixed session_id keeps the authenticated state.

References

https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79312.md
https://github.com/webpy/webpy

Get alerted when CVE-2026-79312 or the next vulnerability affects your stack