CVE-2026-22644

Token Leakage via URL Parameter Enabling Session Hijack

View on CVE.org
Published Jan 15, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker to hijack the user's session and gain unauthorized access.

Analysis

AI-generated

Technical impact

Requests in the product embed authentication tokens in the URL query parameter, which can be captured by logs, proxy servers, or Referer headers. This leakage enables attackers to steal the token, potentially hijack the user’s session, and gain unauthorized access to the system. The vulnerability arises from improper handling of authentication credentials in the URL and can lead to confidentiality loss and unauthorized operations.

Affected Systems

SICK AG Incoming Goods Suite is affected. No specific version information is disclosed.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate risk. The EPSS score is below 1%, suggesting low current exploitation probability. The vulnerability is not listed in KEV, indicating no known exploit in the wild. Attackers would need to observe or capture traffic that includes the URL containing the token, which is feasible on unencrypted channels or when logs are improperly secured. The impact is limited to session hijack, but once hijacked, attackers could gain unrestricted access to the device functions.

Remediation

Vendor Workaround

Please make sure that logs exclude informative level and are stored in a secure way. For more information please follow the official Microsoft Security Considerations document for .NET: https://learn.microsoft.com/en-us/aspnet/core/signalr/security?view=aspnetcore-9.0#access-token-logging Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources ”SICK Operating Guidelines” and ”ICS-CERT recommended practices on Industrial Security” could help to implement the general security practices.

OpenCVE Recommended Actions

  • Configure the system so that authentication tokens are never logged or displayed in query parameters, following secure logging guidelines and disabling logging of sensitive request data.
  • Restrict device/network access to trusted entities only, ensuring that only authenticated users can communicate with the system.
  • Apply SICK Operating Guidelines and other industry best practices for secure device configuration, secure log storage, and network segmentation to mitigate the risk of credential exposure.

Generated by OpenCVE AI on April 18, 2026 at 06:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Token Leakage via URL Parameter Enabling Session Hijack
Type Values Removed Values Added
First Time appeared Sick
Sick incoming Goods Suite
CPEs cpe:2.3:a:sick:incoming_goods_suite:*:*:*:*:*:*:*:*
Vendors & Products Sick
Sick incoming Goods Suite
Type Values Removed Values Added
First Time appeared Sick Ag
Sick Ag incoming Goods Suite
Vendors & Products Sick Ag
Sick Ag incoming Goods Suite
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker to hijack the user's session and gain unauthorized access.
Weaknesses CWE-598
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}
Weaknesses
  • CWE-598

    Use of HTTP Request With Sensitive Query String

Sources

Status
PUBLISHED
Assigner
SICK AG
Published
Updated
Jan 15, 2026, 2:52 PM
Reserved
Jan 8, 2026, 9:59 AM

View source JSON

Updated
Jan 15, 2026, 2:48 PM

JSON

Status
Analyzed
Published
Jan 15, 2026, 2:16 PM
Modified
Jun 17, 2026, 10:20 AM

View source JSON

No data.

Updated
Apr 18, 2026, 6:15 AM

JSON