CWE · MITRE source
CWE-384Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Such a scenario is commonly observed when: In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user's account through the active session.
Last updated: 14 October 2026 22:30 UTC
OWASP Top 10 for Web (2025)
This weakness contributes to A07:2025 Authentication Failures.
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls PROPOSED for this weakness (3)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-23 | Session Authenticity | SC | graded mostly Enforces proper session ID generation and binding, preventing fixation of a known session token. |
AC-12 | Session Termination | AC | Session termination after a set interval shortens the usable lifetime of a fixed session identifier, making successful exploitation of session fixation more difficult. |
IA-11 | Re-authentication | IA | Re-authentication typically forces issuance of a new session, limiting the window for exploitation of a previously fixed session identifier. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2026-102489 KEV UPD | 9.9 | 9.8 | 0.0126 | 2026-09-30 |
CVE-2018-11714 UPD | 9.7 | 9.8 | 0.6706 | 2018-06-04 |
CVE-2018-18925 UPD | 8.9 | 9.8 | 0.3113 | 2018-11-04 |
CVE-2017-12965 UPD | 8.4 | 9.8 | 0.1567 | 2017-08-23 |
CVE-2025-52689 UPD | 8.4 | 9.8 | 0.1432 | 2025-07-16 |
CVE-2021-36394 UPD | 8.1 | 9.8 | 0.0703 | 2023-03-06 |
CVE-2015-4594 UPD | 8.0 | 9.8 | 0.0624 | 2017-01-10 |
CVE-2015-1820 UPD | 7.9 | 9.8 | 0.0435 | 2017-08-09 |
CVE-2019-18418 UPD | 7.9 | 9.8 | 0.0400 | 2019-10-24 |
CVE-2015-1174 UPD | 7.8 | 9.8 | 0.0291 | 2017-08-02 |
CVE-2016-6545 UPD | 7.8 | 9.8 | 0.0302 | 2018-07-13 |
CVE-2018-18926 UPD | 7.8 | 9.8 | 0.0304 | 2018-11-04 |
CVE-2019-5523 UPD | 7.8 | 9.8 | 0.0326 | 2019-04-01 |
CVE-2019-10008 UPD | 7.8 | 8.8 | 0.1940 | 2019-04-24 |
CVE-2016-9125 UPD | 7.7 | 9.8 | 0.0266 | 2017-03-28 |
CVE-2017-12868 UPD | 7.7 | 9.8 | 0.0213 | 2017-09-01 |
CVE-2016-10405 UPD | 7.7 | 9.8 | 0.0193 | 2017-09-07 |
CVE-2018-6959 UPD | 7.7 | 9.8 | 0.0199 | 2018-04-13 |
CVE-2019-10158 UPD | 7.7 | 9.8 | 0.0196 | 2020-01-02 |
CVE-2020-5543 UPD | 7.7 | 9.8 | 0.0221 | 2020-03-16 |
CVE-2020-11729 UPD | 7.7 | 9.8 | 0.0216 | 2020-04-15 |
CVE-2021-20151 UPD | 7.7 | 10.0 | 0.0161 | 2021-12-30 |
CVE-2022-38054 UPD | 7.7 | 9.8 | 0.0214 | 2022-09-02 |
CVE-2023-31498 UPD | 7.7 | 9.8 | 0.0213 | 2023-05-11 |
CVE-2017-12873 UPD | 7.6 | 9.8 | 0.0166 | 2017-09-01 |