CVE-2026-33384 — QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID — CVE Database · The Intelligence Room