Executive brief
ntopng, a popular network traffic monitoring tool, is vulnerable to a security flaw that makes user login sessions predictable. Because the system uses a weak method for generating session IDs, an attacker could potentially guess a valid user's session token and hijack their account. This could allow an unauthorized person to view sensitive network traffic data or modify monitoring configurations.
Technical details
ntopng versions up to and including 6.6 utilize a weak pseudo-random number generator (PRNG) for creating HTTP session identifiers. Specifically, the implementation in src/HTTPserver.cpp relied on time-seeded 'srand' and 'rand' functions, which are not cryptographically secure. An attacker who can predict or control the timing of a login event may be able to determine the resulting session cookie, leading to session hijacking. The vulnerability has been addressed in recent commits by implementing a cryptographically strong random source (using BCrypt on Windows and improved entropy sources on other platforms) and incorporating additional variables like packet counts and usernames into the session generation logic.
Affected products
- ntop ntopng through 6.6
Timeline
- 2026-07-02: advisory: CVE-2026-38968 published by NVD
- 2026-07-02: patched: Fixes committed to ntopng repository