CVE-2026-38968 Weak cryptography in n/a

Critical 9.8 Published 2 Jul 2026 Updated 6 Jul 2026

Attackers can hijack sessions in ntopng by predicting weak time-seeded session identifiers, leading to unauthorized access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-38968?

CVE-2026-38968 is a critical vulnerability in n/a, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.

Weakness: CWE-341

Which versions are affected by CVE-2026-38968?

It affects 1 product.

Products include Ntop Ntopng.

How do I fix CVE-2026-38968?

No fix has been published for CVE-2026-38968 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-38968 being exploited?

There is no known exploitation of CVE-2026-38968 in the wild and no public exploit code.

Sources

Also known as AZL-92103, GHSA-5rrm-76q9-hp77, UBUNTU-CVE-2026-38968.