webpy web.py 0.76 contains a session fixation flaw: its Session._load() method reads a session identifier directly from a cookie and uses it to retrieve session data, while Session._save() writes data back under the same identifier. Because the library never rotates the session ID after a user authenticates, an attacker who can set a predetermined cookie value before login can force that ID into use. Once the victim logs in, the attacker can reuse the same session ID to impersonate the authenticated user, gaining unauthorized access to account resources and data.

The flaw is known to affect webpy web.py version 0.76; other community‑maintained forks that utilize the same session handling code may also be vulnerable, but no specific older or newer releases are listed as impacted.

The CVSS score of 6.8 indicates moderate severity, but the lack of a session‑rotation mechanism creates a high‑risk scenario for any webpy‑based application. EPSS data are not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no documented large‑scale exploitation yet. Nevertheless, the flaw can be exploited remotely by setting a malicious cookie or by having a victim visit a site that issues a fixed session ID, enabling session hijacking without requiring privileged access.