CVE-2026-23796 — Quick.Cart allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session — CVE Database · The Intelligence Room