{"id":"CVE-2026-87755","aliases":[],"cve":{"records":[{"id":"CVE-2026-87755","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-09T07:01:32.622Z","published":"2026-11-10T14:56:29.818Z","modified":"2026-11-10T14:56:29.818Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-10T14:56:29.818Z"}],"references":[{"url":"https://lists.apache.org/thread.html/srzp26oyjtb3bwgxwsyhpphv778s17m8","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-340","description":"CWE-340 Generation of Predictable Numbers or Identifiers","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache TomEE: Stateful session bean hijacking via predictable session identifiers","titleSource":"apache","descriptionSource":"apache","description":"Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","score":null,"severity":"unknown","published":"2026-11-10T14:56:29.818Z","modified":"2026-11-10T14:56:29.818Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"4.0.0-beta-1","status":"affected","lessThanOrEqual":"4.7.5","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.openejb/openejb-core","packageIdentity":{"ecosystem":"Maven","name":"org.apache.openejb:openejb-core"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-87755"},{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"7.0.0-M1","status":"affected","lessThan":"10.0.0-M1","versionType":"semver"},{"version":"10.0.0-M1","status":"affected","lessThan":"10.3.0","versionType":"semver"},{"version":"11.0.0-M1","status":"affected","lessThan":"11.0.0-M2","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.tomee/openejb-core","packageIdentity":{"ecosystem":"Maven","name":"org.apache.tomee:openejb-core"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-87755"}],"remediation":[],"references":["https://lists.apache.org/thread.html/srzp26oyjtb3bwgxwsyhpphv778s17m8"],"sources":[{"name":"CVE","id":"CVE-2026-87755","modified":"2026-11-10T14:56:29.818Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-87755"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-10T15:05:01.673Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T04:30:30.387Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-10T15:05:31.895Z","attemptedAt":"2026-11-10T15:05:31.895Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T15:05:31.895Z","attemptedAt":"2026-11-10T15:05:31.895Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T15:05:31.891Z","attemptedAt":"2026-11-10T15:05:31.891Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T15:05:31.895Z","attemptedAt":"2026-11-10T15:05:31.895Z"}],"evidence":[],"aiSummary":{"text":"Apache TomEE versions 4.0.0-beta-1 to 4.7.5, 7.0.0-M1 to 10.0.0-M1, and 11.0.0-M1 to 11.0.0-M2 have a weakness where stateful session bean identifiers are predictable, allowing a remote attacker with access to the EJB remote endpoint to invoke methods on other clients' sessions. The attacker must hold one valid identifier. The impact is exposure or modification of other users' session state.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T15:06:12.363Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-87755"}]}}