CVE record · 1 source
CVE-2026-97890
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login.
- Vendor
- Apache Software Foundation
- Product
- Apache TomEE
- Weakness
- CWE-384
- Exposure class
- Web platform
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login.
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the…