CVE-2026-79312: webpy Session Fixation Vulnerability

CVE-2026-79312 Overview

CVE-2026-79312 is a session fixation vulnerability in web.py version 0.76, a Python web framework. The flaw resides in the framework's session management logic, where Session._load() reads the session_id directly from the request cookie and loads the corresponding session from the store. The _save() method then writes state back under the same identifier. Because web.py does not rotate the session identifier after authentication, an attacker who plants a known session_id in a victim's browser retains access to the authenticated session once the victim logs in. The issue is classified under CWE-384: Session Fixation.

Critical Impact
An attacker who fixes a session identifier in a victim's browser inherits the victim's authenticated session, enabling account takeover and unauthorized access to protected resources.

Affected Products

web.py 0.76 (Python web framework)
Applications built on web.py 0.76 that rely on the built-in session component
Deployments using default Session._load() and _save() behavior without custom identifier rotation

Discovery Timeline

2026-09-22 - CVE-2026-79312 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in the NVD database

Technical Details for CVE-2026-79312

Vulnerability Analysis

The vulnerability originates in web.py's session lifecycle. When a request arrives, Session._load() extracts the session_id value directly from the client cookie and retrieves the associated session record from the configured session store. After request processing, _save() persists the updated session state under the same identifier without changing it.

Web.py does not regenerate the session_id when a user's authentication state changes. As a result, whichever identifier the client presented before login continues to identify the session after login. An attacker who controls that identifier in advance retains the same reference to the now-authenticated session.

This is a textbook session fixation flaw. Exploitation requires user interaction and depends on the attacker's ability to plant a chosen session_id in the victim's browser, which raises attack complexity but does not eliminate the risk.

Root Cause

The root cause is missing session identifier rotation on authentication state transitions. Secure session handling requires generating a new, unpredictable session_id at every privilege boundary, particularly on login. Web.py 0.76 accepts and reuses whatever identifier the client supplies, coupling pre-authentication and post-authentication sessions to the same value.

Attack Vector

An attacker fixes a session by delivering a controlled session_id cookie to the victim. Common delivery methods include a crafted URL that sets the cookie through an application endpoint, a subdomain cookie injection, or a cross-site scripting (XSS) primitive on a related origin. The victim then authenticates to the target web.py application. Because the session identifier is not rotated, the attacker's fixed value now references the authenticated session, and the attacker can replay the cookie to impersonate the victim. Refer to the GitHub advisory for CVE-2026-79312 and the web.py source repository for implementation details of Session._load() and _save().

Detection Methods for CVE-2026-79312

Indicators of Compromise

Requests where the same session_id cookie value appears both before and immediately after a successful authentication event for a given user.
Multiple distinct client IP addresses or User-Agent strings sharing an identical session_id within a short time window.
Set-Cookie responses from authentication endpoints that do not issue a new session_id.

Detection Strategies

Instrument the authentication flow to log the pre-login and post-login session_id values and alert when they match.
Correlate web server access logs to identify sessions used from geographically or network-diverse sources concurrently.
Review application code for calls to web.session.Session that lack an explicit identifier regeneration step after login.

Monitoring Recommendations

Forward web application and reverse proxy logs to a centralized analytics pipeline and build detections for session identifier reuse across authentication boundaries.
Monitor for anomalous cookie-setting behavior on application endpoints that echo request parameters into Set-Cookie headers.
Track dependency inventories to flag any deployment still running web.py 0.76.

How to Mitigate CVE-2026-79312

Immediate Actions Required

Inventory all applications and services that depend on web.py 0.76 and identify those exposing authenticated functionality.
Implement server-side rotation of the session_id at every login and privilege change, discarding the client-supplied value.
Reject or regenerate any session identifier that does not originate from a prior server-issued Set-Cookie response.
Enforce HttpOnly, Secure, and SameSite=Lax or SameSite=Strict attributes on session cookies to reduce fixation delivery vectors.

Patch Information

No vendor-supplied patch is referenced in the NVD entry at publication time. Monitor the web.py GitHub repository for upstream fixes and consult the CVE-2026-79312 report for the current disclosure status. Until an official fix is available, apply the workarounds below.

Workarounds

Wrap the login handler to invalidate the existing session and issue a freshly generated session_id before writing authenticated state.
Bind session records to client attributes such as a hashed User-Agent or a rotating CSRF token to detect replay from a different client.
Reduce session lifetime and enforce idle timeouts to shrink the exploitation window.
Front the application with a reverse proxy or middleware that strips inbound session_id cookies on unauthenticated requests to authentication endpoints.

bash

# Configuration example: enforce secure cookie attributes for web.py sessions
session_settings = {
    'cookie_name': 'webpy_session_id',
    'cookie_domain': None,
    'cookie_path': '/',
    'timeout': 900,              # 15-minute idle timeout
    'ignore_expiry': False,
    'ignore_change_ip': False,   # Bind session to client IP
    'secret_key': '<replace-with-strong-random-value>',
    'httponly': True,
    'secure': True,              # Require HTTPS
    'samesite': 'Strict',
}

# On successful authentication, force a new session identifier
def login(user):
    session.kill()               # Invalidate the current session
    session._load()              # Load a fresh session record
    session.user_id = user.id    # Persist authenticated state