CVE-2026-12581 · Symaro Security Advisory

Description

EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session ID for a user, they can gain the user's privilege once the user logs in.

Severity (CVSS)

Base score	7.7
Severity	High
Version	CVSS 4.0
Vector	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Provided by	CNA

Weaknesses

CWE-384 — CWE-384 Session fixation

Affected products

Vendor	Product	Versions
Digiwin	EasyFlow .NET	0 to <=8.1.4

References

https://www.twcert.org.tw/tw/cp-132-10980-0e640-1.html (third-party-advisory)
https://www.twcert.org.tw/en/cp-139-10981-8617d-2.html (third-party-advisory)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 22 Jun 2026 14:43 UTC.