[CVE-2026-38968] ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacki…

Descripción técnica

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.

Puntuación CVSS

Score: 9.8/10 — Severidad: CRITICAL — Estado NIST: Analyzed

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Productos afectados

Ntopng — Ntop

Debilidades (CWE)

CWE-341

Fuente oficial

Publicado en NIST NVD.