CVE-2026-23796
CWE-384Published: February 5, 2026· Updated: Jun 17, 2026
Official Description
Quick.Cart allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID
for a victim and later hijack the authenticated session.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.7 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Risk Analysis
Quick.Cart allows session identifiers to be fixed before authentication and maintained after, facilitating session hijacking. This critical vulnerability allows attackers to take over authenticated sessions.
No public exploit is known, and it is not in the CISA KEV catalog. The vulnerability is remotely exploitable.
Implement session regeneration immediately upon successful authentication to invalidate pre-authentication session IDs.
Technical Analysis
CVE-2026-23796 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
All References (2)
Quick Facts
Related CVEs (CWE-384)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-23796 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts