VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Jul 2, 2026· Updated Jul 8, 2026

CVE-2026-38968

CVE-2026-38968

Description

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.

Affected products

2
  • Ntop/Ntopng2 versions
    cpe:2.3:a:ntop:ntopng:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:ntop:ntopng:*:*:*:*:*:*:*:*range: <=6.6
    • (no CPE)range: <=6.6

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.