CVE-2026-79312
Description
A flaw was found in webpy. The session component reads the session identifier from the request cookie and reuses it across authentication state changes without ever rotating it. This allows a pre-authentication session identifier to persist into the authenticated session, enabling an attacker who knows that identifier to access the victim's session after they log in.
Statement
Red Hat does not ship webpy in any supported product. The python-webpy package is available in EPEL, which is maintained by the Fedora community.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
