---
id: "CVE-2026-120223"
kind: "vulnerability"
aliases: ["CVE-2026-120223"]
title: "Oray Pugongying X5 Pro: weak session IDs let remote attackers guess sessions"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "oray-pugongying", "session-management"]
not_affected_if: ["unknown"]
published_at: "2026-11-01T10:18:37+00:00"
first_seen_at: "2026-11-01T10:49:34+00:00"
updated_at: "2026-11-01T10:51:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120223", "first_seen_at": "2026-11-01T10:49:34+00:00"}]
---

# Oray Pugongying X5 Pro: weak session IDs let remote attackers guess sessions

The session handler in Oray Pugongying X5 Pro up to 7.6.1 generates session values that are not random enough, so they can be predicted. An attacker who predicts a valid session value may be able to take over an existing login session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-01T10:49:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120223

## From the sources

A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file session.lua of the component Session ID Handler. The manipulation of the argument _user leads to insufficiently random values. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_