Is CVE-2026-86674 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86674 being exploited in the wild.

How severe is CVE-2026-86674?

Medium severity, with a CVSS score of 6.3, published 8 September 2026.

Which products and versions are affected?

ningzichun Student Management System up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf (versioning not used).

Is there a fix for CVE-2026-86674?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86674 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86674?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86674: ningzichun Student Management System session fixation in login

CVE-2026-86674 · Severity: medium · CVSS 6.3 · Published 2026-09-08

The Student Management System's login handler fails to regenerate session identifiers after successful authentication. An attacker who can set a session ID before a victim logs in can reuse that same ID afterward to hijack the victim's authenticated session and gain unauthorized access to their account, including administrator accounts.

Quick answers

Is CVE-2026-86674 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86674 being exploited in the wild.
How severe is CVE-2026-86674?: Medium severity, with a CVSS score of 6.3, published 8 September 2026.
Which products and versions are affected?: ningzichun Student Management System up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf (versioning not used).
Is there a fix for CVE-2026-86674?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86674 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86674?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a session fixation flaw in the login.php file's session handling. The vulnerable code calls session_start() and sets SESSION variables for login and user/admin roles, but never invokes session_regenerate_id(true) to rotate the session identifier after successful authentication. The attack requires a PHP configuration with session.use_strict_mode disabled (the default in some deployments), allowing an attacker to supply an arbitrary session ID via PHPSESSID cookie. An attacker can set a known session ID before the victim authenticates, then reuse that ID post-login to access the victim's authenticated session. The application does not use versioning, and the vendor has not yet responded to the early disclosure report.

Affected products

ningzichun Student Management System up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf (versioning not used)

Timeline

2026-07-29: disclosed: Issue #16 opened on GitHub
2026-09-08: advisory: CVE-2026-86674 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.