CWE-488.

FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode

• frankenphp
• CWE-488

Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak

• traefik
• CWE-488

CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer

• CWE-488

Strands Agents SDK: Exposure of data element to wrong session in the A2A Server

• CWE-488

<1.5.0 · fixed in 1.5.0

Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak

• traefik
• CWE-488

Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request

• CWE-488

local interface connection reuse mixup

• curl
• CWE-488

FTP connection reuse inherits client-certificate

• curl
• CWE-488

Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State

• Apache Software Foundation Apache Camel
• CWE-488

Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target

• Apache Software Foundation Apache Camel
• CWE-488

FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

• Race condition
• CWE-488

<1.12.5 · fixed in 1.12.5

Pulp-ansible: bearer tokens are reused across remotes in a worker

• Red Hat Ansible Automation Platform 2
• Red Hat Satellite 6
• CWE-488

Pulp-container: registry credentials are reused across remotes in a worker

• Red Hat Ansible Automation Platform 2
• Red Hat Satellite 6
• CWE-488

Apache APISIX: cross-request permission pollution via static permission list mutation

• Apache Software Foundation Apache APISIX
• CWE-488

datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session

• datadrivenconstruction OpenConstructionERP
• CWE-488

rclone: FTP cross-session auth-proxy backend confusion

• CWE-488

>=1.64.0, <1.75.1 · fixed in 1.75.1

Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management

• react-native-auth0
• CWE-488

JetBrains YouTrack: In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft…

• JetBrains YouTrack
• CWE-488

native CA store conn reuse

• curl
• CWE-488

Negotiate ambient user conn reuse

• curl
• CWE-488

IBM ContextForge Translate is affected by cross-client credential context confusion

• IBM ContextForge MCP Gateway - Translate utility
• CWE-488

Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic

• CWE-488

>=1.4.0, <1.11.0 · fixed in 1.11.0

Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

• CWE-488

>=3.8.0, <4.12.34 · fixed in 4.12.34

consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

• HashiCorp Tooling
• CWE-488

terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

• HashiCorp Tooling
• CWE-488

ViewComponent: Reused Component Instances Retain Stale Render Context

• Race condition
• Information disclosure

>=4.0.0, <4.12.0 · fixed in 4.12.0

FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session

• FederatedAI FATE
• CWE-488

wrong reuse for different services

• curl
• CWE-488

n8n: Merge Node SQL Mode Prototype Pollution

• CWE-488

<2.25.7 || >=2.26.0, <2.26.2 · fixed in 2.25.7, 2.26.2

ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition

• Extreme Networks Extreme Platform ONE
• Race condition
• CWE-488

Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest

• CWE-488

<=1.1000.1-0.20260321120606-239e8bd69487 · no fixed version yet

Microsoft UFO shared WebSocket handler state causes cross-client response hijacking

• microsoft UFO
• Broken access control
• CWE-488

wrong reuse of SMB connection

• curl
• CWE-488

Fleet Vulnerable to Windows MDM cross-device command disclosure

• fleet
• CWE-488

NATS is vulnerable to MQTT hijacking via Client ID

• Authentication bypass
• CWE-488

<2.11.15 || >=2.12.0-RC.1, <2.12.6 · fixed in 2.11.15, 2.12.6

Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server

• Zabbix
• CWE-488

Jail chroot escape via fd exchange with a different jail

• FreeBSD
• Privilege escalation
• CWE-488

Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused

• CWE-488

<1.5.1 · fixed in 1.5.1

Whisper Money has IDOR Vulnerability on sync/balances endpoint

• whisper-money
• CWE-488

OpenProject users can delete other user's session, causing them to be logged out

• opf openproject
• CWE-488

SO_REUSEPORT_LB breaks connect(2) for UDP sockets

• FreeBSD
• CWE-488

Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`

• spotipy
• CWE-488

An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0.

• CWE-488

cifs.upcall makes an upcall to the wrong namespace in containerized environments

• cifs-utils
• CWE-488

Improper session handling in B&R APROL

• B&R Industrial Automation GmbH APROL
• Authentication bypass
• CWE-488

Element Android PIN autologout bypass

• element-hq element-android
• CWE-488

Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance

• CWE-488

>=3.16.0.CR1, <3.18.2 || >=3.9.0.CR1, <3.15.3.1 || <3.8.6.1 · fixed in 3.18.2, 3.15.3.1, 3.8.6.1

pgAdmin has Incorrect Default Permissions

• Broken access control
• CWE-488

<7.0 · fixed in 7.0

404 Solution <= 2.35.17 - Missing Authentication to Sensitive Information Exposure

• aaron13100 404 Solution
• CWE-488

Gnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificate

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-488

Siemens RUGGEDCOM RM1224 LTE(4G) EU: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)…

• Siemens RUGGEDCOM RM1224 LTE(4G) EU
• Siemens RUGGEDCOM RM1224 LTE(4G) NAM
• CWE-488

CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking

• CocoaPods
• CWE-488

Undertow's url-encoded request path information can be broken on ajp-listener

• Denial of service
• CWE-488

>=2.3.0.Alpha1, <2.3.14.Final || <2.2.33.Final · fixed in 2.3.14.Final, 2.2.33.Final

TYPO3 Security Misconfiguration in Frontend Session Handling

• CWE-488

>=8.0.0, <8.7.27 || >=9.0.0, <9.5.8 · fixed in 8.7.27, 9.5.8

Improper authorization controls in PaperCut NG/MF

• PaperCut NG, PaperCut MF
• CWE-488

Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination

• CWE-488

>=1.35.1, <1.36.3 · fixed in 1.36.3

In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files.

• Authentication bypass
• CWE-488

Seeing admin password hash value in Mia Technology's Mia-Med

• Mia Technology Inc. MİA-MED
• CWE-488

Intel DCM software: Exposure of data element to wrong session in the Intel DCM software before version 5.0.1…

• Intel DCM software
• CWE-488

Keycloak vulnerable to session takeover with OIDC offline refreshtokens

• Authentication bypass
• CWE-488

<20.0.2 · fixed in 20.0.2