Description
Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user sessions by predetermining session identifiers.
Affected products
creativeitem: academy lms
References1
- suryadina.com/academy-lms-session-fixation-1t8v5n3q6h/ ExploitMitigationThird Party Advisory
Metrics
- CVSS 3.1
-
2.2
LOW
Score source: CNA
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N - EPSS — exploit probability
- 0% percentile: 6 · as of 9 November 2026
- CWE
- CWE-384
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.