{"id":"CVE-2026-97874","kind":"vulnerability","aliases":["CVE-2026-97874"],"related":[],"title":"Hessian remoting skips BASIC authentication on non-root context paths","description":"When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.","summary":"When Hessian remoting uses BASIC authentication, applications deployed under a non-root context path skip the authentication check on their Hessian endpoints. A remote attacker without credentials can invoke the exposed EJB methods.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["basic-auth","ejb","hessian","java","runtime"],"not_affected_if":["auth-not-basic","no-hessian-remoting","root-context-path"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T16:17:26+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","triaged_at":"2026-11-10T16:23:52+00:00","updated_at":"2026-11-10T16:23:52+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T16:23:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Hessian remoting skips BASIC authentication on non-root context paths","impact":"high","summary":"When Hessian remoting uses BASIC authentication, applications deployed under a non-root context path skip the authentication check on their Hessian endpoints. A remote attacker without credentials can invoke the exposed EJB methods.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["hessian","ejb","java","basic-auth"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated remote callers invoke exposed EJB methods directly.","analyst_note":"Identify the affected product and fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-97874 and the upstream vendor advisory; the sources given name neither.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-hessian-remoting","root-context-path","auth-not-basic"],"who_is_affected":"Applications that expose Hessian remoting endpoints with BASIC authentication and are deployed under a non-root context path are exposed. The sources do not name the affected server product or versions. Teams that do not use Hessian remoting, or that serve applications only at the root context path, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4566,"output_tokens":508,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-97874':14A,17A 'access':104C 'anoth':115C 'appli':72C 'applic':31B,77C 'attack':50B,89C 'auth':20B 'authent':5A,30B,42B,66C,68C 'basic':4A,19B,29B,65C 'basic-auth':18B 'block':102C 'check':43B,69C 'client':110C 'configur':63C 'context':10A,38B,84C 'credenti':52B,97C 'cve':12A,15A 'deploy':32B,78C 'ejb':21B,57B,94C 'endpoint':47B,75C,107C 'expos':56B,93C 'hessian':1A,22B,26B,46B,60C,74C,106C 'invok':54B,91C 'java':23B 'method':58B,95C 'migrat':113C 'network':103C 'non':8A,36B,82C 'non-root':7A,35B,81C 'path':11A,39B,85C 'protocol':117C 'recommend':100C 'remot':2A,27B,49B,61C,87C,116C 'root':9A,37B,83C 'runtim':24B 'skip':3A,40B 'unauthent':88C 'untrust':109C 'use':28B 'user':98C 'without':51B,96C","nicknames":[],"mitigations":[],"who_affected":"Applications that expose Hessian remoting endpoints with BASIC authentication and are deployed under a non-root context path are exposed. The sources do not name the affected server product or versions. Teams that do not use Hessian remoting, or that serve applications only at the root context path, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["basicauth","ejb","hessian","java","runtime","unknown"],"campaign_type":null,"search_a":"'-2026':13A,16A '-97874':14A,17A 'authent':5A 'basic':4A 'context':10A 'cve':12A,15A 'hessian':1A 'non':8A 'non-root':7A 'path':11A 'remot':2A 'root':9A 'skip':3A","search_b":"'applic':31B 'attack':50B 'auth':20B 'authent':30B,42B 'basic':19B,29B 'basic-auth':18B 'check':43B 'context':38B 'credenti':52B 'deploy':32B 'ejb':21B,57B 'endpoint':47B 'expos':56B 'hessian':22B,26B,46B 'invok':54B 'java':23B 'method':58B 'non':36B 'non-root':35B 'path':39B 'remot':27B,49B 'root':37B 'runtim':24B 'skip':40B 'use':28B 'without':51B","search_c":"'access':104C 'anoth':115C 'appli':72C 'applic':77C 'attack':89C 'authent':66C,68C 'basic':65C 'block':102C 'check':69C 'client':110C 'configur':63C 'context':84C 'credenti':97C 'deploy':78C 'ejb':94C 'endpoint':75C,107C 'expos':93C 'hessian':60C,74C,106C 'invok':91C 'method':95C 'migrat':113C 'network':103C 'non':82C 'non-root':81C 'path':85C 'protocol':117C 'recommend':100C 'remot':61C,87C,116C 'root':83C 'unauthent':88C 'untrust':109C 'user':98C 'without':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97874","severity":null,"published_at":"2026-11-10T16:17:26+00:00","modified_at":"2026-11-10T16:17:26+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","fetched_at":"2026-11-10T16:22:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}