CVE-2026-23796 is a critical session fixation flaw (CVSS 9.8) in Quick.Cart from OpenSolution. A session ID set before login stays the same after login, so an attacker can fix a victim's session ID and hijack it. Only version 6.7 was tested, and the vendor gave no fix details.
What's affected
Only Quick.Cart 6.7 was tested and confirmed vulnerable, according to the CERT Polska notice. Other versions were not tested and might also be vulnerable.
The notice says the vendor was notified early but did not respond with details of the vulnerability or the vulnerable version range. We found no fixed version in the sources, so we do not name one.
CERT Polska published a second CVE for the same product on the same day, CVE-2026-23797, which covers plaintext storage of passwords that an administrator can view on a user edit page. If you run Quick.Cart, review both.
How to check if you're exposed
Confirm the Quick.Cart version you run, from the admin panel or the files on the server. Then look at the behavior directly in a test copy: sign in and watch whether the session cookie value changes after login. A secure application issues a new session identifier at login.
Also check how the shop is exposed. Public stores are reachable by design, so focus on who holds administrator accounts, how they sign in, and whether admin pages are limited to trusted networks.
What to do now
- Check the vendor site and the CERT Polska notice regularly for a fixed release.
- Restrict the admin area to trusted networks or add a second layer of access control in front of it.
- Use HTTPS only and set cookies with Secure, HttpOnly and SameSite attributes where your setup allows it.
- Ask administrators to use unique passwords, since the sibling CVE concerns how passwords are stored.
- Plan a move to a maintained shop platform if the vendor stays silent.
Why it matters
The weakness is CWE-384 (Session Fixation). The application accepts a session identifier chosen before authentication and keeps using it afterwards. An attacker who can plant a known identifier in a victim's browser waits for the victim to sign in, then uses the same identifier to act as the victim.
The standard fix is to issue a fresh session identifier whenever privilege changes, especially at login, and to invalidate the old one. This is a small code change, but it has to come from the vendor or from whoever maintains your copy. With no vendor details and no confirmed fix, the risk falls on you to contain. The record does not mark this CVE as a CISA Known Exploited Vulnerability.
Quick check
Is there a fixed version?
We found none in the CERT Polska notice. The vendor did not provide details or a version range.
What is session fixation?
An attacker sets or learns a session identifier before login, and it remains valid after the victim signs in.
Sources
Last reviewed: 19 October 2026.
