---
id: "CVE-2026-111259"
page: "https://infrastack.ai/live/CVE-2026-111259"
kind: "vulnerability"
aliases: ["CVE-2026-111259"]
title: "Embedded HTTP server predicts session IDs, letting attackers hijack sessions"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["embedded-server", "http-sessions", "java", "package"]
not_affected_if: ["no-http-sessions", "token-auth"]
published_at: "2026-11-10T16:17:16+00:00"
first_seen_at: "2026-11-10T16:22:33+00:00"
updated_at: "2026-11-10T16:24:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111259", "first_seen_at": "2026-11-10T16:22:33+00:00"}]
exploit_sources: []
---

# Embedded HTTP server predicts session IDs, letting attackers hijack sessions

Link for people: https://infrastack.ai/live/CVE-2026-111259 (this .md is for agents)

The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. An attacker who observes session identifiers can predict those issued to other users and take over their sessions if the application uses HTTP sessions for login.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find the embedded server version in the build file or lockfile and check whether it is `10.3.0` or later in the `10.x` line, or `11.0.0-M2` or later in the `11.x` line.
- Check whether the application uses HTTP sessions for authentication.

## Fix

- Upgrade to `10.3.0` or `11.0.0-M2`, per the description.

## Timeline

- 2026-11-10T16:22:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111259

## From the sources

The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_