CVE-2026-103279: Js Incomplete Session Invalidation Skip Current Session
Incomplete session invalidation: a session whose identifier matches a skip value is deliberately spared by $SESSION.destroy(), or the current session id is stored as an invalidation-skip option. When this protects a password change or reset, the spared session id is exactly the value carried in the user's session cookie, so a stolen or cloned cookie keeps au
JSgreprules fetch cve-2026-103279-js-incomplete-session-invalidation-skip-current-session --engine opengrepDescription
Incomplete session invalidation: a session whose identifier matches a skip value is deliberately spared by $SESSION.destroy(), or the current session id is stored as an invalidation-skip option. When this protects a password change or reset, the spared session id is exactly the value carried in the user's session cookie, so a stolen or cloned cookie keeps au
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.