CVE-2020-5290

CVE-2020-5290 describes a session fixation vulnerability in RedpwnCTF versions prior to 2.3, affecting CTFd and rCTF platforms. An attacker can exploit this by manipulating the #token=$ssid hash on the /verify endpoint, potentially leveraging stored XSS to force victim teams into the attacker's account. This medium-severity vulnerability (CVSS 6.5) has a low attack complexity and requires user interaction, leading to high integrity impact as attackers could steal flags and gain points. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.