# CVE-2026-86279: SourceCodester Syllabus-Aligned Learning Management System session fixation in auth_process.php

Source: https://junglewise.ai/threats/cve-2026-86279-sourcecodester-syllabus-aligned-learning-management-system  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86279 · Severity: medium · CVSS 6.3 · Published 2026-09-07

The Syllabus-Aligned Learning Management & Examination System is a web-based platform used for managing course syllabi and student assessments. A session fixation vulnerability in the login component allows an attacker to hijack user sessions and gain unauthorized access to student or instructor accounts without requiring valid credentials.

Technologies: [SourceCodester Syllabus-Aligned Learning Management & Examination System](https://junglewise.ai/threats/technologies/syllabus-aligned-learning-management-examination-system). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-86279 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86279 being exploited in the wild.

**How severe is CVE-2026-86279?** Medium severity, with a CVSS score of 6.3, published 7 September 2026.

**Which products and versions are affected?** SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0.

**Is there a fix for CVE-2026-86279?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86279 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86279?** Check whether you run SourceCodester Syllabus-Aligned Learning Management & Examination System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a session fixation flaw in the auth_process.php login component that fails to regenerate session identifiers after successful authentication. An attacker can force a victim to use a known session token, then leverage that same token to impersonate the victim after they log in. The attack is remotely accessible without authentication. Related issues include incomplete authorization checks, missing session destruction on logout, no session timeout enforcement, and missing secure cookie flags. No patch information is currently available for version 1.0.

## Affected products

- SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0

## Timeline

- 2026-09-07: disclosed: Publicly disclosed vulnerability report
- 2026-09-07: advisory: CVE-2026-86279 published

## References

- [https://github.com/hackliu/Vulnerability-Reports/blob/master/Syllabus%20Aligned%20Learning%20Management%20Examination%20System/VULN-06-Session-Management-Flaws.md](https://github.com/hackliu/Vulnerability-Reports/blob/master/Syllabus%20Aligned%20Learning%20Management%20Examination%20System/VULN-06-Session-Management-Flaws.md)
- [https://vuldb.com/cve/CVE-2026-86279](https://vuldb.com/cve/CVE-2026-86279)

## Related threats

- [SourceCodester Syllabus-Aligned Learning Management & Examination System CSRF in state-changing operations](https://junglewise.ai/threats/cve-2026-86281-sourcecodester-syllabus-aligned-learning-management-examination)
- [SourceCodester Syllabus-Aligned LMS cleartext storage of sensitive information](https://junglewise.ai/threats/cve-2026-86280-sourcecodester-syllabus-aligned-lms-cleartext-storage-of)
- [SourceCodester Syllabus-Aligned LMS reflected and stored XSS](https://junglewise.ai/threats/cve-2026-86278-sourcecodester-syllabus-aligned-lms-reflected-and-stored-xss)
- [SourceCodester Syllabus-Aligned Learning Management System authorization bypass](https://junglewise.ai/threats/cve-2026-86277-sourcecodester-syllabus-aligned-learning-management-system)
- [SourceCodester Syllabus-Aligned Learning Management & Examination System hardcoded credentials and SQL injection](https://junglewise.ai/threats/cve-2026-86276-sourcecodester-syllabus-aligned-learning-management-examination)