The vulnerability arises because tirreno fails to regenerate the session identifier after successful authentication, leaving the session ID unchanged. As a result, an attacker who can predefine a session ID for a target—such as via a man‑in‑the‑middle position, cross‑site scripting, or subdomain cookie‑injection—can later exploit that same session to access the victim’s authenticated account. This flaw falls under CWE‑384 and allows an attacker to hijack sessions without requiring any privileged access.

The affected product is tirrenotechnologies’ tirreno framework, with all releases before version 0.10.0 vulnerable. Updating to tirreno v0.10.0 or newer removes the defect because the session ID is regenerated and the prior session is destroyed upon successful login.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, though the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack requires the attacker to set a session identifier ahead of authentication, a condition that can arise in realistic scenarios such as compromised network links or unmitigated XSS. Once the session hijack succeeds, the attacker can operate under the victim’s credentials, potentially accessing confidential data or performing privileged actions. Therefore, while the exploitation difficulty is moderate, the impact on confidentiality and integrity can be significant.