---
id: CVE-2026-64857
title: >-
  tirreno, a security framework, has a session fixation issue in versions prior
  to 0.10.0
summary: >-
  tirreno, a security framework, has a session fixation issue in versions prior
  to 0.10.0. During authentication, tirreno validates the user's credentials and
  establishes the authenticated session, but it does not call
  `session_regenerate_…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-384
vendor: tirrenotechnologies
product: tirreno
affected:
  - tirreno < 0.10.0
published: '2026-09-09'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:20:21.673'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64857'
references:
  - url: 'https://github.com/tirrenotechnologies/tirreno/releases/tag/v0.10.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/tirrenotechnologies/tirreno/security/advisories/GHSA-gwcm-4p9m-9mvr
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-09T14:03:44.268223Z'
cvssSource: cna
ingestedAt: '2026-09-12T09:18:27.110Z'
epss: 0.0047
epssPercentile: 0.37945
---

## Overview

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call `session_regenerate_id()` afterward. As a result, the session identifier is not rotated on login, it stays the same before and after authentication. An attacker able to fix a known session identifier in a victim's browser (for example through a network man-in-the-middle position, or a separate cross-site scripting or subdomain cookie-injection issue) could then gain access to the victim's authenticated session. The issue is fixed in v0.10.0. The session identifier is now regenerated on successful authentication, and the previous session is destroyed. There is no configuration-level workaround.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.