CVE-2026-25072

The record

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a predictable session identifier vulnerability in the /goform/SetLogin endpoint that allows remote attackers to hijack authenticated sessions. Attackers can predict session identifiers using insufficiently random cookie values and exploit exposed session parameters in URLs to gain unauthorized access to authenticated user sessions.

Affected packages

Related vulnerabilities

• CVE-2026-114576 A vulnerability has been found in Linksys RE6250 1.0.04.001. CWE-330
• CVE-2026-53939 OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption… CWE-330
• CVE-2026-79575 The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current… CWE-330
• CVE-2026-86187 WWBN AVideo generates passwords for external-login accounts using rand() instead of a… CWE-330
• CVE-2026-17274 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass… CWE-330
• CVE-2026-66047 ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated… CWE-330
• CVE-2026-81852 Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a… CWE-330
• CVE-2026-82555 A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. CWE-330