Skip to content

CVE record · 1 source

CVE-2026-87755

Stateful session bean identifiers are not generated from a cryptographically secure random source.

Vendor: Apache Software Foundation
Product: Apache TomEE
Weakness: CWE-340
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

25

CVE NVD 2h ago

Stateful session bean identifiers are not generated from a cryptographically secure random source.

Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients'…

Fix available CVE-2026-87755 Apache Software Foundation