[ CVE-2025-71455 · Published 4 Nov 2026 ]
Vulnerability in vtenext
CVSS 5.3
No fix listed yet
[ Description ]Official description
vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.