Exposure of Data Element to Wrong Session
CWE-488
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
We track 27 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3.
How this weakness is prevented
- Architecture and Design: Protect the application's sessions from information leakage. Make sure that a session's data is not used or visible by other sessions.
- Testing: Use a static analysis tool to scan the code for information leakage vulnerabilities (e.g. Singleton Member Field).
- Architecture and Design: In a multithreading environment, storing user data in Servlet member fields introduces a data access race condition. Do not use member fields to store information in the Servlet.
Latest Exposure of Data Element to Wrong Session vulnerabilities
- 8.7 High severity
traefik: Exposure of Data Element to Wrong Session
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthent
- 8.1 High severity
strands-agents: Exposure of Data Element to Wrong Session
The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conver
- 8.7 High severity
traefik: Exposure of Data Element to Wrong Session
Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be h
- 8.1 High severity
curl: Exposure of Data Element to Wrong Session
When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silen
- 9.1 Critical severity
curl: Exposure of Data Element to Wrong Session
An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new
- 7.7 High severity
frankenphp: Concurrent Execution using Shared Resource with Improper Synchronization
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In thi
- 7.3 High severity
rclone: Exposure of Data Element to Wrong Session
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass map[
- 7.5 High severity
curl: Exposure of Data Element to Wrong Session
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.
- 9.8 Critical severity
curl: Exposure of Data Element to Wrong Session
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated conn
- 7.4 High severity
ContextForge MCP Gateway - Translate utility: Exposure of Data Element to Wrong Session
IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.
- 10.0 Critical severity
Tooling: Exposure of Data Element to Wrong Session
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fi
- 10.0 Critical severity
Tooling: Exposure of Data Element to Wrong Session
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This
- 7.7 High severity
n8n: Exposure of Data Element to Wrong Session
n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could pollute the sandbox used by the Merge node's SQL Query mode. Because the sandbox context was cached and re
- 7.5 High severity
curl: Server-Side Request Forgery
libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria mus
- 7.5 High severity
fleet: Exposure of Data Element to Wrong Session
Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows MDM command processing allows a malicious enrolled device to access MDM commands intended for other devices, potentially exposing sensitive configuration data
- 7.5 High severity
FreeBSD: Improper Privilege Management
If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancestor of the other, jailed processes may nonetheless be able to access a shared directory via a nullfs mount, if the admini
- 9.1 Critical severity
spotipy: Exposure of Data Element to Wrong Session
Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/integration_tests.yml` followed by the checking out the head.sha of a forked PR can be exploited by at
- 8.3 High severity
Red Hat Build of Apache Camel 4.8 for Quarkus…: Exposure of Data Element to Wrong Session
A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive inf
- 7.5 High severity
Pgadmin: Exposure of Data Element to Wrong Session
A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously.
- 7.5 High severity
Red Hat Enterprise Linux 10: Exposure of Data Element to Wrong Session
A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a resul
- 8.0 High severity
RUGGEDCOM RM1224 LTE(4G) EU: Exposure of Data Element to Wrong Session
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.1), SCALANCE M812-1
- 9.6 Critical severity
CocoaPods: Exposure of Data Element to Wrong Session
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim’s sess
- 7.5 High severity
EAP 8.0.1: Exposure of Data Element to Wrong Session
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to inco
- 8.3 High severity
deno: Exposure of Data Element to Wrong Session
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from N
- 9.1 Critical severity
assetwise_alim_web: Exposure of Data Element to Wrong Session
In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files. This is fixed in Assetwise ALIM Web 23.00.04.04 and Assetwise Information Integrity Server 23.00.02.
- 7.5 High severity
MİA-MED: Exposure of Data Element to Wrong Session
Exposure of Data Element to Wrong Session vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects MİA-MED: before 1.0.7.
- 7.8 High severity
Intel DCM software: Exposure of Resource to Wrong Sphere
Exposure of data element to wrong session in the Intel DCM software before version 5.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.