PatchSiren cyber security CVE debrief
CVE-2026-33384 OpenSolution CVE debrief
Session fixation vulnerability in QuickCMS allows pre-authentication session ID assignment that persists after login, enabling session hijacking attacks.
- Vendor
- OpenSolution
- Product
- QuickCMS
- CVSS
- MEDIUM 4.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-29
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-29
- Advisory updated
- 2026-05-29
Who should care
QuickCMS administrators, web application security teams, and organizations running unpatched QuickCMS deployments prior to version 6.8.
Technical summary
QuickCMS fails to regenerate session identifiers upon successful authentication, allowing attackers who can fix a victim's session ID prior to login to hijack the authenticated session. The vulnerability stems from accepting externally-supplied session identifiers before authentication and failing to issue new session tokens post-authentication. CVSS 4.0 score of 4.8 reflects local attack vector with user interaction required. Patch available since 2026-05-15 for version 6.8.
Defensive priority
medium
Recommended defensive actions
- Apply QuickCMS version 6.8 patch released 2026-05-15 or later to remediate session fixation vulnerability
- Regenerate all active session identifiers after patching to invalidate potentially fixed sessions
- Implement additional session security controls including rotation of session IDs upon authentication and binding sessions to client IP/user-agent where feasible
- Monitor for anomalous session activity including concurrent usage from disparate geolocations or user-agents
Evidence notes
CVE published 2026-05-29 with CVSS 4.8 (MEDIUM). CERT.PL advisory confirms session fixation behavior where attacker-controlled session IDs survive authentication. Patch released 2026-05-15 for version 6.8. NVD status currently Deferred.
Official resources
2026-05-29