---
id: "CVE-2026-125078"
page: "https://infrastack.ai/live/CVE-2026-125078"
kind: "vulnerability"
aliases: ["CVE-2026-125078"]
title: "SourceCodester Smart Attendance System: login.php session fixation lets attackers hijack sessions"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Smart Attendance System with QR Code Scanner", "fixed": [], "affected": "1.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["other", "php", "self-hosted", "smart-attendance-system"]
not_affected_if: ["not-deployed"]
published_at: "2026-11-10T00:17:06+00:00"
first_seen_at: "2026-11-10T00:28:41+00:00"
updated_at: "2026-11-10T00:32:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125078", "first_seen_at": "2026-11-10T00:28:41+00:00"}, {"source": "analyst", "url": "https://vuldb.com/vuln/433183", "first_seen_at": "2026-11-10T00:32:36+00:00", "cites": ["https://vuldb.com/vuln/433183"]}]
exploit_sources: []
---

# SourceCodester Smart Attendance System: login.php session fixation lets attackers hijack sessions

Link for people: https://infrastack.ai/live/CVE-2026-125078 (this .md is for agents)

SourceCodester Smart Attendance System with QR Code Scanner 1.0 has a session fixation flaw (CWE-384) in login.php: the session ID is not renewed at login, so an attacker who plants a known session ID in a victim's browser can reuse it after the victim logs in. VulDB reports a public proof of concept; no exploitation in the wild is reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Smart Attendance System with QR Code Scanner affected 1.0 fixed no fixed version listed

## How to check

Only version 1.0 is reported. Check whether the app is deployed: look for SourceCodester Smart Attendance System with QR Code Scanner in your web root. To test, note the PHPSESSID cookie before login at login.php; if the same value is still valid after login, the session is not rotated and the app is exposed.

## Fix

No fixed version or vendor patch known as of 2026-11-10 (VulDB: no countermeasure known; suggests replacing the product). A code-level workaround is to call session_regenerate_id(true) after successful login in login.php.

## Timeline

- 2026-11-10T00:28:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125078
- 2026-11-10T00:32:36+00:00 analyst https://vuldb.com/vuln/433183 — Read VulDB VDB-433183 (CNA, secondary; the GitHub advisory/PoC it cites is not linked there, so not read). CWE-384, login.php, no named parameter, unauth remote, needs user interaction, public PoC reported by VulDB, no vendor fix or countermeasure known. Nothing verified: no vendor page exists.

## Documents

- [describes] VulDB VDB-433183: Smart Attendance System login.php session fixation https://vuldb.com/vuln/433183

## From the sources

A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_