{"id":"CVE-2026-97890","kind":"vulnerability","aliases":["CVE-2026-97890"],"related":[],"title":"Embedded HTTP server keeps old session ID after login, enabling session hijack","description":"The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.","summary":"The embedded HTTP server does not invalidate the previous session identifier when an application changes the session ID, such as after login. An attacker who can plant a session ID in a victim's browser can take over that victim's authenticated session.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded-http-server","other","session-management"],"not_affected_if":["network-access-blocked-from-untrusted-clients"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T16:17:27+00:00","first_seen_at":"2026-11-10T16:22:36+00:00","triaged_at":"2026-11-10T16:23:48+00:00","updated_at":"2026-11-10T16:23:48+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T16:23:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Embedded HTTP server keeps old session ID after login, enabling session hijack","impact":"high","summary":"The embedded HTTP server does not invalidate the previous session identifier when an application changes the session ID, such as after login. An attacker who can plant a session ID in a victim's browser can take over that victim's authenticated session.","audience":"businesses","category":"other","nicknames":[],"who_cares":["embedded-http-server","session-management"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker hijacks authenticated user sessions in the browser","analyst_note":"Identify the affected embedded HTTP server product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-97890 and any Apache TomEE advisory; confirm the fixed version.","how_to_check":"unknown","plain_action":"","product_name":"unknown","needs_analyst":true,"not_affected_if":["network-access-blocked-from-untrusted-clients"],"who_is_affected":"The sources describe an embedded HTTP server that does not rotate session IDs when an application changes them, such as after login. Teams running applications on that embedded server are exposed if an attacker can plant a session ID in a user's browser. The sources name no affected versions and no product, so the exact scope is unknown.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000718,"input_tokens":4559,"output_tokens":525,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-97890':15A,18A 'access':117C 'applic':40B,83C 'attack':50B,92C 'authent':68B,109C 'base':132C 'block':115C 'browser':61B,103C 'chang':41B,84C 'client':125C 'cve':13A,16A 'distribut':134C 'e.g':88C 'embed':1A,20B,28B,71C,120C 'embedded-http-serv':19B 'enabl':10A 'hijack':12A,105C 'http':2A,21B,29B,72C,121C 'id':7A,44B,56B,87C 'identifi':37B,80C,98C 'invalid':33B,76C 'keep':4A 'login':9A,48B,90C 'manag':26B 'migrat':128C 'network':116C 'old':5A 'plant':53B,95C 'previous':35B,78C 'recommend':113C 'server':3A,22B,30B,73C,122C 'session':6A,11A,25B,36B,43B,55B,69B,79C,86C,97C,110C 'session-manag':24B 'take':63B 'tomcat':131C 'tome':133C 'untrust':124C 'user':111C 'victim':59B,66B,101C,107C","nicknames":[],"mitigations":[],"who_affected":"The sources describe an embedded HTTP server that does not rotate session IDs when an application changes them, such as after login. Teams running applications on that embedded server are exposed if an attacker can plant a session ID in a user's browser. The sources name no affected versions and no product, so the exact scope is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embeddedhttpserver","other","sessionmanagement","unknown"],"campaign_type":null,"search_a":"'-2026':14A,17A '-97890':15A,18A 'cve':13A,16A 'embed':1A 'enabl':10A 'hijack':12A 'http':2A 'id':7A 'keep':4A 'login':9A 'old':5A 'server':3A 'session':6A,11A","search_b":"'applic':40B 'attack':50B 'authent':68B 'browser':61B 'chang':41B 'embed':20B,28B 'embedded-http-serv':19B 'http':21B,29B 'id':44B,56B 'identifi':37B 'invalid':33B 'login':48B 'manag':26B 'plant':53B 'previous':35B 'server':22B,30B 'session':25B,36B,43B,55B,69B 'session-manag':24B 'take':63B 'victim':59B,66B","search_c":"'access':117C 'applic':83C 'attack':92C 'authent':109C 'base':132C 'block':115C 'browser':103C 'chang':84C 'client':125C 'distribut':134C 'e.g':88C 'embed':71C,120C 'hijack':105C 'http':72C,121C 'id':87C 'identifi':80C,98C 'invalid':76C 'login':90C 'migrat':128C 'network':116C 'plant':95C 'previous':78C 'recommend':113C 'server':73C,122C 'session':79C,86C,97C,110C 'tomcat':131C 'tome':133C 'untrust':124C 'user':111C 'victim':101C,107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97890","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97890","severity":null,"published_at":"2026-11-10T16:17:27+00:00","modified_at":"2026-11-10T16:17:27+00:00","first_seen_at":"2026-11-10T16:22:36+00:00","fetched_at":"2026-11-10T16:22:36+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}