WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute, and the vulnerable session handler affects all PHP pages. This issue is fixed in version 3.8.6.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00343.

Exploitation poc

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
LabRedesCefetRJ WeGIA affected
Version Status Constraints
< 3.8.6 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/LabRedesCefetRJ/WeGIA/commit/f59cad3ac7292225e88699cac82775a9f534be05 cve-icon cve-icon
https://github.com/LabRedesCefetRJ/WeGIA/issues/221 cve-icon cve-icon
https://github.com/LabRedesCefetRJ/WeGIA/pull/1705 cve-icon cve-icon
https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6 cve-icon cve-icon
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-5xhr-jrv8-j4j2 cve-icon cve-icon cve-icon
History

Thu, 15 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Description WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute, and the vulnerable session handler affects all PHP pages. This issue is fixed in version 3.8.6.
Title WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php
Weaknesses CWE-200
CWE-384
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-15T13:58:06.066Z

Reserved: 2026-06-17T00:13:10.649Z

Link: CVE-2026-55682

cve-icon Vulnrichment

Updated: 2026-10-15T13:58:01.070Z

cve-icon NVD

Status : Deferred

Published: 2026-10-14T20:17:50.487

Modified: 2026-10-15T14:17:26.393

Link: CVE-2026-55682

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-15T13:15:07Z

Weaknesses