CVE-2026-104469

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7

Description A session fixation issue exists because the login process fails to regenerate the PHP session ID. This allows an attacker who has set or obtained a victim's pre-authentication YesWiki-* session cookie to reuse that identifier after the victim authenticates, enabling the attacker to hijack the session, access private content, and perform actions using the victim's privileges.

Recommendations Update to version 4.6.7 or later.