{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-111259","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","state":"PUBLISHED","assignerShortName":"apache","dateReserved":"2026-10-15T18:59:33.398Z","datePublished":"2026-11-10T15:18:07.791Z","dateUpdated":"2026-11-10T15:18:07.791Z"},"containers":{"cna":{"providerMetadata":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-11-10T15:18:07.791Z"},"title":"Apache TomEE: Predictable HTTP session identifiers in embedded server","problemTypes":[{"descriptions":[{"description":"CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","lang":"en","cweId":"CWE-338","type":"CWE"}]}],"source":{"discovery":"INTERNAL"},"affected":[{"vendor":"Apache Software Foundation","product":"Apache TomEE","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.tomee:tomee-embedded","packageURL":"pkg:maven/org.apache.tomee/tomee-embedded","versions":[{"status":"affected","version":"7.0.0-M1","lessThan":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"10.0.0-M1","lessThan":"10.3.0","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","lessThan":"11.0.0-M2","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"value":"The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","lang":"en","supportingMedia":[{"type":"text/html","base64":false,"value":"The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}]}],"references":[{"url":"https://lists.apache.org/thread/1sk4193kxtf18q2so25c62c2b73o94lg","tags":["vendor-advisory"]}],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"moderate"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"credits":[{"lang":"en","value":"The Apache Software Foundation","type":"finder"},{"lang":"en","value":"Claude Security","type":"tool"},{"lang":"en","value":"Markus Jung","type":"remediation developer"}],"x_generator":{"engine":"Vulnogram 1.0.3"}}}}