YesWiki before version 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because the application does not regenerate the PHP session ID after a user logs in. An attacker who can set or learn a victim's pre‑authentication YesWiki- session cookie can reuse it once the victim authenticates, gaining access to private content and performing actions with the victim's privileges, which results in a loss of confidentiality, integrity, and availability for that session.

All installations of YesWiki running a version earlier than 4.6.7 are impacted. The flaw is tied to the AuthController.php login logic and affects any deployment that relies on PHP session management.

The CVSS score of 7.6 marks this as a high‑moderate risk vulnerability. The EPSS score is not available, and the issue is not listed in CISA KEV, indicating that no widespread exploitation has been documented yet. Based on the description, it is inferred that an attacker must first set or discover a victim’s pre‑authentication session cookie, which could be achieved through social engineering, cross‑site scripting, or other methods that allow cookie injection. Once that prerequisite is met, the attacker can hijack the session immediately after the victim logs in without any additional authentication, demonstrating a remote exploitation path that can be leveraged by an attacker with internet access.