CVE record · 1 source
CVE-2026-111246
The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications.
- Vendor
- Apache Software Foundation
- Product
- Apache TomEE
- Weakness
- CWE-668
- Exposure class
- Web platform
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications.
The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web application in another one, which then trusts session state set by the first…