Executive brief
Cacti, an open-source network monitoring and fault management framework, is vulnerable to session fixation. An attacker can potentially pre-set a session identifier for a victim; once the victim logs in, the attacker can use that same identifier to hijack the user's active session. This could allow an unauthorized individual to access the monitoring dashboard and view or modify network performance data.
Technical details
A session fixation vulnerability exists in Cacti's authentication logic within `auth_login.php` and `include/auth.php`. The application fails to call `session_regenerate_id()` after a successful login, meaning the session identifier remains static before and after authentication. An attacker can exploit this by providing a known session ID to a victim (e.g., via subdomain cookie injection or XSS); once the victim authenticates, the attacker can use the fixed ID to hijack the session. While Cacti uses secure cookie flags (HttpOnly, SameSite=Strict), these do not mitigate fixation via same-site vectors. The issue is resolved in version 1.2.31 by ensuring session rotation occurs during the login transition.
Affected products
- Cacti Cacti <= 1.2.30
Timeline
- 2026-06-15: patched: Version 1.2.31 released
- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: CVE published to NVD