{"id":"CVE-2026-111259","kind":"vulnerability","aliases":["CVE-2026-111259"],"related":[],"title":"Embedded HTTP server predicts session IDs, letting attackers hijack sessions","description":"The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. An attacker who observes session identifiers can predict those issued to other users and take over their sessions if the application uses HTTP sessions for login.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded-server","http-sessions","java","package"],"not_affected_if":["no-http-sessions","token-auth"],"how_to_check":"- Find the embedded server version in the build file or lockfile and check whether it is `10.3.0` or later in the `10.x` line, or `11.0.0-M2` or later in the `11.x` line.\n- Check whether the application uses HTTP sessions for authentication.","fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, per the description.","status":"open","published_at":"2026-11-10T16:17:16+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","triaged_at":"2026-11-10T16:24:06+00:00","updated_at":"2026-11-10T16:24:06+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-10T16:24:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, per the description.","reach":"internet","title":"Embedded HTTP server predicts session IDs, letting attackers hijack sessions","impact":"high","summary":"The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. An attacker who observes session identifiers can predict those issued to other users and take over their sessions if the application uses HTTP sessions for login.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","embedded-server","http-sessions"],"confidence":0.5,"fix_status":"available","needs_auth":"no","worst_case":"Attacker predicts session IDs and takes over other users' accounts.","analyst_note":"Identify the embedded server product and its affected version range from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111259.","how_to_check":"- Find the embedded server version in the build file or lockfile and check whether it is `10.3.0` or later in the `10.x` line, or `11.0.0-M2` or later in the `11.x` line.\n- Check whether the application uses HTTP sessions for authentication.","plain_action":"","product_name":"unknown","needs_analyst":true,"not_affected_if":["no-http-sessions","token-auth"],"who_is_affected":"Applications that run the embedded server by default and rely on HTTP sessions to keep users logged in are exposed. Applications that do not use HTTP sessions for authentication are not affected by the session prediction risk. The product name and exact affected version range are not given in the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000757,"input_tokens":4563,"output_tokens":602,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111259':13A,16A '-2026':12A,15A '10.3.0':121C '11.0.0':123C 'applic':62B,107C 'attack':8A,43B,87C 'authent':113C 'cryptograph':36B,79C 'cve':11A,14A 'default':41B,84C 'embed':1A,18B,26B,69C 'embedded-serv':17B 'fix':126C 'generat':28B,39B,71C,82C 'hijack':9A,102C 'http':2A,21B,29B,64B,72C,110C 'http-session':20B 'id':6A 'identifi':31B,47B,74C,92C,96C 'issu':51B,97C,128C 'java':23B 'let':7A 'login':67B 'm2':124C 'non':35B,78C 'non-cryptograph':34B,77C 'number':38B,81C 'observ':45B,89C 'packag':24B 'predict':4A,49B,94C 'random':37B,80C 'recommend':116C 'reli':108C 'remot':86C 'server':3A,19B,27B,70C 'session':5A,10A,22B,30B,46B,59B,65B,73C,91C,104C,111C 'take':56B 'upgrad':118C 'use':63B 'user':54B,100C,114C 'version':120C","nicknames":[],"mitigations":[],"who_affected":"Applications that run the embedded server by default and rely on HTTP sessions to keep users logged in are exposed. Applications that do not use HTTP sessions for authentication are not affected by the session prediction risk. The product name and exact affected version range are not given in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embeddedserver","httpsessions","java","package","unknown"],"campaign_type":null,"search_a":"'-111259':13A,16A '-2026':12A,15A 'attack':8A 'cve':11A,14A 'embed':1A 'hijack':9A 'http':2A 'id':6A 'let':7A 'predict':4A 'server':3A 'session':5A,10A","search_b":"'applic':62B 'attack':43B 'cryptograph':36B 'default':41B 'embed':18B,26B 'embedded-serv':17B 'generat':28B,39B 'http':21B,29B,64B 'http-session':20B 'identifi':31B,47B 'issu':51B 'java':23B 'login':67B 'non':35B 'non-cryptograph':34B 'number':38B 'observ':45B 'packag':24B 'predict':49B 'random':37B 'server':19B,27B 'session':22B,30B,46B,59B,65B 'take':56B 'use':63B 'user':54B","search_c":"'10.3.0':121C '11.0.0':123C 'applic':107C 'attack':87C 'authent':113C 'cryptograph':79C 'default':84C 'embed':69C 'fix':126C 'generat':71C,82C 'hijack':102C 'http':72C,110C 'identifi':74C,92C,96C 'issu':97C,128C 'm2':124C 'non':78C 'non-cryptograph':77C 'number':81C 'observ':89C 'predict':94C 'random':80C 'recommend':116C 'reli':108C 'remot':86C 'server':70C 'session':73C,91C,104C,111C 'upgrad':118C 'user':100C,114C 'version':120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111259","severity":null,"published_at":"2026-11-10T16:17:16+00:00","modified_at":"2026-11-10T16:17:16+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","fetched_at":"2026-11-10T16:22:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}