CVE-2026-92984

Name of the Vulnerable Software and Affected Versions HUBzero CMS versions prior to 2.2.33

Description The software accepts session identifiers from query strings and request variables instead of relying exclusively on cookies. This allows unauthenticated attackers to perform session fixation, where they obtain a valid session identifier and trick a victim into using it via a crafted link. Once the victim authenticates, the attacker can replay the identifier to hijack the account and gain unauthorized access.

Recommendations Update HUBzero CMS to version 2.2.33 or later.