Session Fixation Vulnerability in Neuvector's SAML and OIDC Authentication
CVE-2026-78428

8HIGH

Key Information:

Vendor

Go

Status
Neuvector
Vendor
CVE Published:
17 September 2026

What is CVE-2026-78428?

This vulnerability affects users authenticated via SAML or OpenID Connect (OIDC) in Neuvector, where concurrent single sign-on (SSO) login attempts may lead to unintended session sharing. This allows one user to inadvertently receive another user’s authenticated session, compromising the integrity and confidentiality of user sessions. Proper session management and secure handling of authentication tokens are crucial to mitigate such risks.

Affected Version(s)

neuvector <5.6.1

References

https://github.com/neuvector/neuvector/security/advisorie...
https://bugzilla.suse.com/show_bug.cgi?id=1279937

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.