Session Fixation Vulnerability in Neuvector's SAML and OIDC Authentication
CVE-2026-78428

8.8HIGH

Key Information:

Vendor

Suse
Status
Neuvector
Vendor
CVE Published:
17 September 2026

What is CVE-2026-78428?

This vulnerability affects users authenticated via SAML or OpenID Connect (OIDC) in Neuvector, where concurrent single sign-on (SSO) login attempts may lead to unintended session sharing. This allows one user to inadvertently receive another user’s authenticated session, compromising the integrity and confidentiality of user sessions. Proper session management and secure handling of authentication tokens are crucial to mitigate such risks.

Affected Version(s)

neuvector <5.6.1

References

https://github.com/neuvector/neuvector/security/advisorie...
vendor-advisory
https://bugzilla.suse.com/show_bug.cgi?id=1279937
issue-tracking

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.