CVE-2026-38968
Critical · 9.8CVSS
9.8
EPSS
—
Published
Jul 2, 2026
CISA due date
—
The record
ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-87913 A missing S3 bucket ownership verification in the AWS Security Agent MCP server before… CWE-341
- CVE-2026-87912 A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon… CWE-341
- CVE-2026-15571 A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a… CWE-341
- CVE-2026-36609 Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static… CWE-341
- CVE-2026-42365 A guessable session cookie vulnerability exists in the Web Interface functionality of… CWE-341