Session Fixation Vulnerability in Tirreno Security Framework

CVE-2026-64857

What is CVE-2026-64857?

The Tirreno Security Framework has a session fixation vulnerability that affects versions prior to 0.10.0. This issue occurs because, during the authentication process, the framework fails to regenerate the session identifier after validating user credentials. As a result, the same session identifier is used before and after successful login. This flaw could be exploited by attackers who are able to fix a session identifier on the victim's browser, potentially via network interception or through cross-site scripting attacks. The vulnerability is resolved in version 0.10.0, where the framework now properly regenerates session identifiers, thus enhancing security by destroying previous sessions.

References