{"id":"CVE-2026-97890","aliases":[],"cve":{"records":[{"id":"CVE-2026-97890","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T09:27:03.286Z","published":"2026-11-10T15:31:25.681Z","modified":"2026-11-10T15:31:25.681Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-10T15:31:25.681Z"}],"references":[{"url":"https://lists.apache.org/thread/2wx7lvso54j2xp6m7omq12hkcb9tfzjx","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-384","description":"CWE-384 Session Fixation","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache TomEE: Session fixation in embedded HTTP server","titleSource":"apache","descriptionSource":"apache","description":"The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.","score":null,"severity":"unknown","published":"2026-11-10T15:31:25.681Z","modified":"2026-11-10T15:31:25.681Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"7.0.0-M1","status":"affected","lessThan":"10.0.0-M1","versionType":"semver"},{"version":"10.0.0-M1","status":"affected","lessThanOrEqual":"10.2.0","versionType":"semver"},{"version":"11.0.0-M1","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.tomee/openejb-http","packageIdentity":{"ecosystem":"Maven","name":"org.apache.tomee:openejb-http"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-97890"}],"remediation":[],"references":["https://lists.apache.org/thread/2wx7lvso54j2xp6m7omq12hkcb9tfzjx"],"sources":[{"name":"CVE","id":"CVE-2026-97890","modified":"2026-11-10T15:31:25.681Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-97890"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-10T15:46:25.371Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:00:31.976Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-10T16:20:52.853Z","attemptedAt":"2026-11-10T16:20:52.853Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T16:20:34.945Z","attemptedAt":"2026-11-10T16:20:34.945Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-10T16:20:35.432Z","attemptedAt":"2026-11-10T16:20:35.432Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T16:20:34.860Z","attemptedAt":"2026-11-10T16:20:34.860Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-121257","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-121257","modified":"Nov 10, 2026, 3:31:25 PM","checkedAt":"2026-11-10T16:20:35.432Z"},{"source":"NVD","id":"CVE-2026-97890","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97890","modified":"2026-11-10T16:17:27.153","checkedAt":"2026-11-10T16:20:52.853Z"}],"aiSummary":{"text":"Apache TomEE's embedded HTTP server has a session fixation weakness, potentially allowing an attacker with access to a victim's browser to hijack their authenticated session. Affected versions include 7.0.0-M1, 10.0.0-M1 to 10.2.0, and 11.0.0-M1. An attacker must be able to plant a session identifier in the victim's browser.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T15:51:44.411Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-97890"}]}}