CVE-2026-92984 HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier
Attackers can hijack user accounts by fixing session identifiers via query strings in HUBzero CMS, allowing unauthorized access after victim authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-92984?
CVE-2026-92984 is a high-severity authentication bypass vulnerability in hubzero-cms, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted link containing it, and replay the identifier after the victim authenticates to hijack their account and access.
Weakness: CWE-384
Which versions are affected by CVE-2026-92984?
How do I fix CVE-2026-92984?
No fix has been published for CVE-2026-92984 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-92984 being exploited?
There is no known exploitation of CVE-2026-92984 in the wild and no public exploit code.
Sources
Also known as GHSA-jq63-mx4g-ww7g.