CVE-2026-120223 | Oray Pugongying X5 Pro up to 7.6.1 Session ID session.lua session_get _user random values

October 31, 2026 Yanac

A vulnerability was found in Oray Pugongying X5 Pro up to 7.6.1. It has been classified as problematic. This impacts the function session_get of the file session.lua of the component Session ID Handler. The manipulation of the argument _user leads to insufficiently random values.

This vulnerability is documented as CVE-2026-120223. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More