CVE-2026-55682 LabRedesCefetRJ CVE debrief

Who should care

Defenders responsible for WeGIA installations should assess exposure to this session fixation vulnerability and prioritize upgrading to version 3.8.6 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure, apply patches, and monitor for suspicious activity to prevent session hijacking and internal database host name disclosure.

Why it matters

Defenders should prioritize verifying exposure of WeGIA installations to this session fixation vulnerability and upgrading to version 3.8.6 or later to prevent session hijacking and internal database host name disclosure.

• Session hijacking is possible if an attacker can supply a PHPSESSID cookie
• Internal database host name disclosure through the cookie Domain attribute
• Verification of WeGIA installations and upgrade to version 3.8.6 or later is necessary

Technical summary

The auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute.

Defensive priority

Defenders should prioritize verifying exposure of WeGIA installations to this session fixation vulnerability and upgrading to version 3.8.6 or later.

Recommended defensive actions

• Verify exposure of WeGIA installations to this session fixation vulnerability
• Upgrade to version 3.8.6 or later
• Monitor for suspicious session activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide information on the session fixation vulnerability in WeGIA. The vulnerability is caused by the auto-prepended web/html/seguranca/sessionStart.php reflecting an attacker-supplied PHPSESSID cookie in a Set-Cookie response and using DB_HOST as the cookie domain.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.