The vulnerability arises from improper handling of session_start in the authentication module, allowing an attacker to set a valid session identifier before a user logs in. This session fixation can enable the attacker to hijack the victim’s account and gain unauthorized access to sensitive resources, compromising confidentiality and integrity of the system. The flaw can be triggered remotely by an attacker delivering a crafted request to the server.

The affected product is Mstfakts College-Management-System. No specific version information is available because the project uses rolling releases, meaning all current releases may be vulnerable until a fix is released.

The CVSS score of 5.3 indicates a moderate severity, and the exploitability is confirmed to be remote with publicly disclosed methods. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. According to the description, an attacker can manipulate the session_start call by sending a pre-set session identifier, then log in and assume the victim’s session. It is inferred that no special access beyond the ability to send HTTP requests to the authentication endpoint is required.