CVE-2026-2177

HighPublic PoC

Published: 08 February 2026

Published

08 February 2026

Modified

10 February 2026

KEV Added

—

Patch

—

CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0006 20.1th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2177 is a high-severity Session Fixation (CWE-384) vulnerability in Fast5 Prison Management System. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-12 Session Termination

addresses: CWE-384

Session termination after a set interval shortens the usable lifetime of a fixed session identifier, making successful exploitation of session fixation more difficult.

IA-11 Re-authentication

addresses: CWE-384

Re-authentication typically forces issuance of a new session, limiting the window for exploitation of a previously fixed session identifier.

SC-23 Session Authenticity

addresses: CWE-384

Enforces proper session ID generation and binding, preventing fixation of a known session token.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1550.004 Web Session Cookie Lateral Movement

Adversaries can use stolen session cookies to authenticate to web applications and services.

attack.mitre.org →

Why these techniques?

Session fixation in a public-facing login component directly enables remote exploitation of the application (T1190) and use of a pre-set web session identifier as alternate authentication material to hijack a valid user session (T1550.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability has been found in SourceCodester Prison Management System 1.0. The impacted element is an unknown function of the component Login. The manipulation leads to session fixiation. It is possible to initiate the attack remotely. The exploit has been…

disclosed to the public and may be used.

Deeper analysisAI

CVE-2026-2177 is a session fixation vulnerability (CWE-384) in an unknown function of the Login component within SourceCodester Prison Management System 1.0. Published on 2026-02-08, it carries a CVSS v3.1 base score of 7.3 (High), rated as AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating network accessibility with low attack complexity, no privileges or user interaction required, and low impacts across confidentiality, integrity, and availability.

The vulnerability enables remote exploitation where an attacker manipulates session handling during login, potentially allowing session hijacking if a victim authenticates using a pre-set session identifier controlled by the attacker. Unauthenticated attackers can initiate this remotely, achieving partial compromise of user sessions.

Advisories reference VulDB entries (ctiid.344880, id.344880, submit.749485) and a GitHub issue (https://github.com/hater-us/CVE/issues/10), noting that the exploit has been publicly disclosed and may be used. The vendor site (https://www.sourcecodester.com/) is listed for further details, though no specific patches or mitigations are outlined in the core description.