# CVE-2026-38968: ntop ntopng predictable session identifier in HTTPserver

Source: https://junglewise.ai/threats/cve-2026-38968-ntop-ntopng-predictable-session-identifier-in-httpserver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-38968 · Severity: info · CVSS 0 · Published 2026-07-02

ntopng, a popular network traffic monitoring tool, is vulnerable to a security flaw that makes user login sessions predictable. Because the system uses a weak method for generating session IDs, an attacker could potentially guess a valid user's session token and hijack their account. This could allow an unauthorized person to view sensitive network traffic data or modify monitoring configurations.

Technologies: [Ntopng](https://junglewise.ai/threats/technologies/ntopng). Vendors: [Ntop](https://junglewise.ai/threats/vendors/ntop).

## Quick answers

**Is CVE-2026-38968 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-38968 being exploited in the wild.

**How severe is CVE-2026-38968?** Informational severity, with a CVSS score of 0, published 2 July 2026.

**Which products and versions are affected?** Ntopng through 6.6.

**Is there a fix for CVE-2026-38968?** A patch was published on 2026-07-02: Fixes committed to ntopng repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-38968 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-38968?** Check whether you run Ntopng at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

ntopng versions up to and including 6.6 utilize a weak pseudo-random number generator (PRNG) for creating HTTP session identifiers. Specifically, the implementation in src/HTTPserver.cpp relied on time-seeded 'srand' and 'rand' functions, which are not cryptographically secure. An attacker who can predict or control the timing of a login event may be able to determine the resulting session cookie, leading to session hijacking. The vulnerability has been addressed in recent commits by implementing a cryptographically strong random source (using BCrypt on Windows and improved entropy sources on other platforms) and incorporating additional variables like packet counts and usernames into the session generation logic.

## Affected products

- ntop ntopng through 6.6

## Timeline

- 2026-07-02: advisory: CVE-2026-38968 published by NVD
- 2026-07-02: patched: Fixes committed to ntopng repository

## References

- [https://github.com/ntop/ntopng/commit/14e22497233dc7d31d19dccb74b13bb073d16c2c](https://github.com/ntop/ntopng/commit/14e22497233dc7d31d19dccb74b13bb073d16c2c)
- [https://github.com/ntop/ntopng/commit/179a346ceb6239fd36128ccca3efa8f9ea61eeb5](https://github.com/ntop/ntopng/commit/179a346ceb6239fd36128ccca3efa8f9ea61eeb5)

## Related threats

- [ntopng stack buffer overflow in nDPI custom category detection](https://junglewise.ai/threats/cve-2026-97371-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng OS command injection in vulnerability-scan REST endpoint](https://junglewise.ai/threats/cve-2026-82413-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng authorization bypass in system configuration backup download](https://junglewise.ai/threats/cve-2026-84990-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng missing authorization check in blacklist editor](https://junglewise.ai/threats/cve-2026-83621-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng remote code execution via unauthenticated scan endpoints](https://junglewise.ai/threats/cve-2026-82412-ntopng-is-a-web-based-network-traffic-monitoring-application)