Apache TomEE up to 10.0.0-M0/10.2.0/11.0.0-M1 Embedded HTTP Server session fixiation

Summaryinfo

A vulnerability, which was classified as critical, was found in Apache TomEE up to 10.0.0-M0/10.2.0/11.0.0-M1. This affects an unknown part of the component Embedded HTTP Server. Such manipulation leads to session fixiation. This vulnerability is referenced as CVE-2026-97890. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Apache TomEE up to 10.0.0-M0/10.2.0/11.0.0-M1. Affected by this issue is some unknown functionality of the component Embedded HTTP Server. The manipulation with an unknown input leads to a session fixiation vulnerability. Using CWE to declare the problem leads to CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.

The advisory is shared for download at lists.apache.org. This vulnerability is handled as CVE-2026-97890 since 09/25/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/10/2026).

Upgrading to version 10.0.0-M1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Apache

Name

• TomEE

Version

• 10.0
• 10.0.0-M0
• 10.1
• 10.2.0
• 11.0.0-M1

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion