CVE-2026-97874 · Runtime
NO FIX YET
When Hessian remoting uses BASIC authentication, applications deployed under a non-root context path skip the authentication check on their Hessian endpoints. A remote attacker without credentials can invoke the exposed EJB methods.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that expose Hessian remoting endpoints with BASIC authentication and are deployed under a non-root context path are exposed. The sources do not name the affected server product or versions. Teams that do not use Hessian remoting, or that serve applications only at the root context path, are not affected.
Not affected if auth-not-basic, no-hessian-remoting, root-context-path
Who cares basic-auth, ejb, hessian, java
Unknown from the sources.
Unknown from the sources.
When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.