CVE-2026-34917

Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restricted to admin users. An attacker could leverage this to gain unauthorised access and exploit API‑level vulnerabilities. The session context (web/API) is now recorded along with other session data, preventing session IDs from being used interchangeably.

• CWE-287

• https://hackerone.com/reports/3672641

Published

Jun 23, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34911A malicious actor with access to the network and low privile…7.7
• CVE-2026-34912A missing access control check when linking banners or campa…4.3
• CVE-2026-34913A missing access control check when linking trackers to camp…4.3
• CVE-2026-34914A missing sanitisation of user input in the zone-include.php…8.3
• CVE-2026-34915A missing sanitisation of user input in the zone-include.php…6.1
• CVE-2026-34916A missing validation of user input when saving delivery limi…8.8
• CVE-2026-3492The Gravity Forms plugin for WordPress is vulnerable to Stor…6.4
• CVE-2026-34926A directory traversal vulnerability in the Apex One (on-prem…6.7
• CVE-2026-34927An origin validation vulnerability in the Apex One/SEP agent…7.8
• CVE-2026-34928An origin validation vulnerability in the Apex One/SEP agent…7.8
• CVE-2026-34929An origin validation vulnerability in the Apex One/SEP agent…7.8
• CVE-2026-34930An origin validation vulnerability in the Apex One/SEP agent…7.8