CVE-2026-97890
Apache TomEE: Session fixation in embedded HTTP server
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
What each source reports
CVE List No score
Apache TomEE: Session fixation in embedded HTTP server
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
- Record
CVE-2026-97890- Weakness
- CWE-384
- Updated
- 2026-11-10
EUVDEUVD-2026-121257 No score
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
- Record
EUVD-2026-121257- Updated
- 2026-11-10
GitHub AdvisoriesGHSA-wc4m-p226-f6jx No score
The embedded HTTP server does not invalidate the previous session identifier when an application...
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
- Record
GHSA-wc4m-p226-f6jx- Weakness
- CWE-384
- Updated
- 2026-11-10
NVD No score
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
- Record
CVE-2026-97890- Weakness
- CWE-384
- Updated
- 2026-11-10
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD | |
| published | EUVD | |
| aliases, references | GitHub Advisories, NVD | |
| cwes, references, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-97890 is a vulnerability with no CVSS score yet in Apache Software Foundation Tomee, published November 10, 2026. No source lists public exploit code. No source names a fixed version.