{"id":"CVE-2026-71302","published":"2026-09-29T22:18:18.817","lastModified":"2026-09-29T22:18:18.817","description":"The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover.","cvssScore":7.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","cwes":["CWE-384"],"vendors":[],"products":[],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json","tags":[]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02","tags":[]},{"url":"https://www.toptech.com/blog/tms7-version-7-8-strengthens-security","tags":[]}],"exploitRefs":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json","tags":[]}],"hasPoc":true,"ai":null}