---
id: "CVE-2026-97874"
page: "https://infrastack.ai/live/CVE-2026-97874"
kind: "vulnerability"
aliases: ["CVE-2026-97874"]
title: "Hessian remoting skips BASIC authentication on non-root context paths"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["basic-auth", "ejb", "hessian", "java", "runtime"]
not_affected_if: ["auth-not-basic", "no-hessian-remoting", "root-context-path"]
published_at: "2026-11-10T16:17:26+00:00"
first_seen_at: "2026-11-10T16:22:35+00:00"
updated_at: "2026-11-10T16:23:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97874", "first_seen_at": "2026-11-10T16:22:35+00:00"}]
exploit_sources: []
---

# Hessian remoting skips BASIC authentication on non-root context paths

Link for people: https://infrastack.ai/live/CVE-2026-97874 (this .md is for agents)

When Hessian remoting uses BASIC authentication, applications deployed under a non-root context path skip the authentication check on their Hessian endpoints. A remote attacker without credentials can invoke the exposed EJB methods.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T16:22:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97874

## From the sources

When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_