CVE-2026-103279: Js Incomplete Session Invalidation Skip Current Sessioncve-2026-103279-js-incomplete-session-invalidation-skip-current-session
Incomplete session invalidation: a session whose identifier matches a skip value is deliberately spared by $SESSION.destroy(), or the current session id is stored as an invalidation-skip option. When this protects a password change or reset, the spared session id is exactly the value carried in the user's session cookie, so a stolen or cloned cookie keeps au
