Quick answers
- Is CVE-2026-125078 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-125078 being exploited in the wild.
- How severe is CVE-2026-125078?
- Medium severity, with a CVSS score of 6.3, published 10 November 2026.
- Which products and versions are affected?
- SourceCodester Smart Attendance System with QR Code Scanner 1.0.
- Is there a fix for CVE-2026-125078?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-125078 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-125078?
- Check whether you run SourceCodester Smart Attendance System with QR Code Scanner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a session fixation flaw (CWE-384) in login.php where session_start() accepts attacker-controlled session IDs and the application fails to call session_regenerate_id() after authentication. An unauthenticated attacker can obtain a valid pre-authentication session ID, plant it in a victim's browser via subdomain cookie, MITM, or XSS, and after the victim logs in, reuse that same ID to access the authenticated administrative dashboard. No session binding or rotation occurs upon privilege escalation.
Affected products
- SourceCodester Smart Attendance System with QR Code Scanner 1.0
Timeline
- 2026-10-17: disclosed
- 2026-11-10: advisory