Skip to main content

Session Fixation

CVE-2025-55668

Medium
6.5/10

Summary

Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects org.apache.tomcat:tomcat-catalina: versions from 8.0.0-RC1 through 8.0.53, 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.105, 10.1.0-M1 through 10.1.41 and 11.0.0-M1 through 11.0.7.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • REQUIRED
  • NONE
  • HIGH
  • NONE

CWE-384 - Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References

Advisory Timeline

  • Published