CVE-2026-104469 Overview
CVE-2026-104469 is a session fixation vulnerability in YesWiki before version 4.6.7. The flaw exists in AuthController.php because the login process does not regenerate the PHP session identifier after successful authentication. Attackers who plant or obtain a victim's pre-authentication YesWiki-* session cookie can reuse that cookie after the victim logs in. The reused cookie grants the attacker access to private content and the ability to perform actions with the victim's privileges. The weakness is classified under CWE-384: Session Fixation.
Critical Impact
Attackers can hijack authenticated YesWiki sessions and act with the victim's privileges by reusing a pre-authentication session cookie.
Affected Products
- YesWiki versions prior to 4.6.7
- AuthController.php login flow in YesWiki
- Any YesWiki deployment where attackers can set or observe YesWiki-* session cookies
Discovery Timeline
- 2026-10-02 - CVE-2026-104469 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-104469
Vulnerability Analysis
YesWiki uses PHP sessions to track authenticated users through a session cookie named with the YesWiki-* prefix. The login handler in AuthController.php validates credentials and binds authentication state to the existing session identifier. The handler does not call a session regeneration routine such as session_regenerate_id(true) after authentication succeeds. The pre-login session identifier therefore remains valid and becomes an authenticated session once the victim completes login. An attacker who knows that identifier can issue authenticated requests as the victim and read private pages or submit changes on their behalf.
Root Cause
The root cause is missing session identifier regeneration during the authentication state transition. Secure session handling requires replacing the session ID when privilege level changes, which prevents an attacker-controlled identifier from carrying authenticated state. YesWiki before 4.6.7 reuses the pre-authentication identifier, satisfying the conditions for [CWE-384].
Attack Vector
The attack requires the attacker to deliver a known session cookie to the victim before login. Common delivery techniques include a crafted link that sets the cookie via a sibling subdomain, a cross-site scripting primitive on a related host, or a man-in-the-middle position on an unencrypted channel. The victim then authenticates to YesWiki with the attacker-known identifier. The attacker reuses the same cookie against the YesWiki instance and inherits the victim's authenticated session. Exploitation complexity is non-trivial because it requires victim interaction and cookie delivery, but no credentials or prior privileges are needed on the YesWiki application itself. See the GitHub Security Advisory GHSA-7fvc-v2hp-5pwh and the VulnCheck Advisory on YesWiki for additional context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-104469
Indicators of Compromise
- Authenticated YesWiki requests that reuse a YesWiki-* session cookie first observed before the user's successful login event.
- Multiple distinct source IP addresses or user agents using the same YesWiki session identifier within a short window.
- Account activity (edits, administrative actions, access to private pages) from geolocations or devices that do not match the account owner.
Detection Strategies
- Correlate web server access logs with YesWiki authentication events to identify session IDs that persist unchanged across the pre-login to post-login boundary.
- Alert on YesWiki sessions whose cookie value predates the associated login timestamp for the user.
- Hunt for suspicious Set-Cookie activity on related domains that could seed a YesWiki session identifier into a victim's browser.
Monitoring Recommendations
- Enable verbose logging on the YesWiki authentication path and ship logs to a central analytics platform for correlation.
- Monitor concurrent use of the same session identifier from differing client fingerprints and flag deviations.
- Review YesWiki audit trails for privileged actions performed shortly after login events on accounts with elevated roles.
How to Mitigate CVE-2026-104469
Immediate Actions Required
- Upgrade all YesWiki instances to version 4.6.7 or later without delay.
- Invalidate all existing YesWiki sessions after upgrade to force reauthentication with regenerated identifiers.
- Audit recent administrative and content-modification activity for signs of session reuse during the exposure window.
Patch Information
YesWiki 4.6.7 corrects the login flow in AuthController.php to regenerate the PHP session identifier at authentication. Administrators should apply the upstream release referenced in the GitHub Security Advisory GHSA-7fvc-v2hp-5pwh. The VulnCheck Advisory on YesWiki confirms the fixed version and describes the affected code path.
Workarounds
- Enforce HTTPS site-wide and set the Secure and HttpOnly attributes on YesWiki session cookies to limit cookie interception.
- Configure the session cookie SameSite attribute to Lax or Strict to reduce cross-site cookie injection vectors.
- Restrict administrative access to YesWiki by source IP or VPN until the upgrade is complete.
- Instruct users to clear browser cookies for the YesWiki domain before logging in during the exposure window.
# Configuration example
# Example PHP session hardening in php.ini for YesWiki hosts
session.cookie_secure = 1
session.cookie_httponly = 1
session.cookie_samesite = "Lax"
session.use_strict_mode = 1
session.use_only_cookies = 1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
