CVE-2008-1396

CVE-2008-1396 describes an authentication bypass vulnerability in Plone CMS 3.x. The flaw stems from the use of invariant data (client username and server secret) in the HMAC-SHA1 calculation for authentication cookies, making it susceptible to network sniffing. This medium-complexity vulnerability allows remote attackers to gain permanent account access, resulting in a partial compromise of confidentiality. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.