Session Hijacking Vulnerability in ntopng by ntop
CVE-2026-38968

9.8CRITICAL

Key Information:

Vendor

ntop

Status
ntopng
Vendor
CVE Published:
2 July 2026

What is CVE-2026-38968?

The ntopng through version 6.6 has a security flaw due to predictable session identifiers that can potentially enable session hijacking attacks. This vulnerability arises from the use of weak time-seeded pseudo-randomness in session creation, specifically evident in the HTTP session identifiers within the src/HTTPserver.cpp file. As a result, attackers can exploit this flaw to generate deterministic or colliding session cookies, endangering authenticated user sessions and providing unauthorized access to sensitive operations.

References

https://github.com/ntop/ntopng/commit/179a346ceb6239fd361...
https://github.com/ntop/ntopng/commit/14e22497233dc7d31d1...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.