CVE-2026-101268
Description
If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is available on a different domain than the organizer page.
Is your site exposed to CVE-2026-101268?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Other References
Frequently Asked Questions
What is CVE-2026-101268? +
How do I check if I'm vulnerable to CVE-2026-101268? +
Related Vulnerabilities
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session …
tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's …
QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same …
KTM System e-BOK allows the session identifier to be set by the client prior to authentication. If a cookie with …
Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issue affects OAuth: from …
Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if …