Executive brief
tirreno is a PHP security framework used to build authentication and access control systems. A session fixation vulnerability allows an attacker who can set a victim's session cookie (via man-in-the-middle, XSS, or subdomain cookie injection) to hijack the victim's authenticated session after they log in. The framework failed to rotate session IDs upon successful login, allowing the attacker's pre-set session identifier to remain valid even after authentication.
Technical details
The vulnerability is a session fixation issue (CWE-384) in tirreno's authentication mechanism. During login, the framework validates credentials and establishes an authenticated session, but fails to call `session_regenerate_id()` to rotate the session identifier. Consequently, the session ID remains unchanged before and after authentication. An attacker with the ability to inject or fix a session identifier in a victim's browser—via network MITM, XSS, or subdomain cookie injection—can later use that known session ID to access the authenticated session. The vulnerability affects all versions prior to v0.10.0, which regenerates the session ID on successful login and destroys the previous session. No configuration-level workaround exists; upgrade is required.
Affected products
- tirreno tirreno <0.10.0
Timeline
- 2026-06-28: disclosed: Reported by Pranav Pandit
- 2026-07-02: patched: Fixed in v0.10.0
- 2026-07-09: advisory: GitHub Security Advisory GHSA-gwcm-4p9m-9mvr published
- 2026-09-09: other: CVE-2026-64857 published on NVD