CVE-2026-103283: Js Session Auth Flag Carried Over Without Identity Binding
A session authentication/verification flag is conditionally inherited from a previous session, but the deny-guard short-circuits on the mere truthiness of the previous identity ($PREV_ID && ...). When the previous session has no bound identity (e.g. it was logged out and only the flag was left behind, or it predates identity binding), the guard evaluates fal
JSgreprules fetch cve-2026-103283-js-session-auth-flag-carried-over-without-identity-binding --engine opengrepDescription
A session authentication/verification flag is conditionally inherited from a previous session, but the deny-guard short-circuits on the mere truthiness of the previous identity ($PREV_ID && ...). When the previous session has no bound identity (e.g. it was logged out and only the flag was left behind, or it predates identity binding), the guard evaluates fal
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.