Session Management Vulnerability in TMS7 by TopTech
CVE-2026-71302
7.5HIGH
What is CVE-2026-71302?
This vulnerability occurs when the TMS7 application accepts user-supplied session identifiers without regenerating the session ID post-authentication. Attackers can exploit this flaw by predetermining a session ID, allowing them to reuse it after a victim successfully authenticates. This weakness opens the door for session takeover attacks, where malicious actors can gain unauthorized access to user sessions, leading to potential data breaches and unauthorized actions within the application.
Affected Version(s)
TMS7 7.6.3
TopHAT 7.6.3
TMS7 7.8
References
CVSS V4
Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Sachin Shetty and Roy Duisters of Shell CyberDefence reported this vulnerability to Toptech and CISA.