WeGIA: Session fixation and database host disclosure in session handler
Summary
WeGIA, a web manager for charitable institutions, has a flaw in its auto-prepended session handler (sessionStart.php). It reflects a user-supplied PHPSESSID cookie in a Set-Cookie response and uses the database host name as the cookie domain, which also discloses the internal DB_HOST value. An attacker who gets a victim to log in with an session identifier chosen by the attacker can reuse it to hijack the authenticated session. The handler affects all PHP pages.
Affected
- WeGIA versions before 3.8.6
- VulDB reports the range as up to 3.8.5
Fixed in
- Fixed in WeGIA 3.8.6
- Version 3.8.7 is the current release and also includes the fix
Workaround
- Unknown. No vendor workaround was found in the sources. Upgrading is the documented fix.
Exploitation
- CISA SSVC: exploitation status 'poc' (proof of concept exists), automatable: no, technical impact: total.
- Not listed in CISA KEV.
- No in-the-wild exploitation reports found.
Our recommendation
- Identify all WeGIA instances and check whether they are reachable from the internet.
- Upgrade to WeGIA 3.8.7 (or at least 3.8.6).
- Review session settings and restrict access to the application where possible.
- Monitor logins for unusual session activity until the upgrade is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5xhr-jrv8-j4j2 github.com
- Fix commit f59cad3 github.com
- WeGIA release 3.8.6 github.com
- WeGIA issue #221 github.com
- OpenCVE CVE-2026-55682 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:03.
Original description (NVD)
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute, and the vulnerable session handler affects all PHP pages. This issue is fixed in version 3.8.6.
NVD references (6)
- https://github.com/LabRedesCefetRJ/WeGIA/commit/f59cad3ac7292225e88699cac82775a9f534be05
- https://github.com/LabRedesCefetRJ/WeGIA/issues/221
- https://github.com/LabRedesCefetRJ/WeGIA/pull/1705
- https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-5xhr-jrv8-j4j2
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-5xhr-jrv8-j4j2
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.