CVE-2024-10318

CVE-2024-10318 is a medium-severity session fixation vulnerability in the NGINX OpenID Connect reference implementation, affecting products like f5 nginx_api_connectivity_manager and f5 nginx_ingress_controller. The flaw allows an attacker to fix a victim's session to an attacker-controlled account by exploiting an unchecked nonce during login. This could lead to unauthorized access and misuse of the victim's session, although the attacker cannot directly log in as the victim. The vulnerability has a CVSS score of 5.4, indicating a network-based attack with low complexity and user interaction required. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.