CVE-2026-55682

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.6

Description The auto-prepended 'web/html/seguranca/sessionStart.php' reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB HOST as the cookie domain. This allows an attacker to hijack an authenticated session if a victim authenticates using an identifier selected by the attacker. Additionally, the internal database host name is disclosed through the cookie Domain attribute. This issue affects all PHP pages due to the vulnerable session handler.

Recommendations Update to version 3.8.6.