CVE-2026-71302 — Toptech TMS7 and TopHAT Session Fixation
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reus…
Published: 2026-09-29 · CVSS: 7.5 · CVSS 4.0
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7