Bludit allows a user to set a session identifier before authentication, and the same value persists after the user logs in. This flaw, classified as a session fixation vulnerability (CWE‑384), lets an attacker fix a session ID for a victim and subsequently hijack the victim’s authenticated session, gaining unauthorized access to the victim’s account and any data protected by that session.

The flaw affects the Bludit content management system in all releases prior to version 3.17.2. No specific sub‑versions are cited, so any installation running an older version is potentially impacted.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker delivering a preset session cookie or token to the victim before login—such as through a malicious link or crafted HTTP request—after which the attacker can reuse that session ID to access the victim’s authenticated session.