Session ID Vulnerability in Quick.Cart by OpenSolution

CVE-2026-23796

What is CVE-2026-23796?

Quick.Cart suffers from a serious flaw that allows an attacker to set a user's session identifier before authentication occurs. The problematic implementation ensures that this session ID remains unchanged even after the user authenticates. As a result, an attacker can exploit this behavior to fix a session ID for an unsuspecting victim, ultimately gaining unauthorized access to an authenticated session. While version 6.7 has been tested and confirmed vulnerable, it remains unclear whether earlier or later versions are similarly affected, as the vendor has not disclosed further details.

References