CVE-2026-78428: Flaw in Neuvector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently

High severity · published Sep 17, 2026

CVE-2026-78428

Flaw in Neuvector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently

8.8

CVSS

0.3%

EPSS

On KEV

Description

For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 19% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

neuvector · SUSE

<5.6.1 · source: vendor

Affected product

neuvector

SUSE

All neuvector CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-78428

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-78428

vendor-advisory

https://github.com/neuvector/neuvector/security/advisories/GHSA-c6rx-pmvf-m3jx

issue-tracking

https://bugzilla.suse.com/show_bug.cgi?id=1279937