OpenCart 3.0.3.8 mishandles the OCSESSID cookie, allowing an attacker to supply a crafted value that the server accepts as a valid session identifier. This flaw enables session fixation, where the attacker forces a known session ID on a victim, leading to session takeover and unauthorized access to the victim’s account. The weakness is a direct Authentication issue, classified as CWE‑290.

The vulnerability affects the OpenCart 3.0.3.8 release. Systems running this exact version of the OpenCart e‑commerce platform are at risk, irrespective of the underlying operating system or hosting environment.

The CVSS score of 9.3 marks this flaw as Critical, reflecting high impact and exploitability. EPSS data is not available, so the actual likelihood of exploitation in the wild is unknown, but the lack of mitigations and the straightforward cookie manipulation make it relatively easy to exploit. The vulnerability is not listed in CISA’s KEV catalog at this time.