---
id: "CVE-2026-97890"
page: "https://infrastack.ai/live/CVE-2026-97890"
kind: "vulnerability"
aliases: ["CVE-2026-97890"]
title: "Embedded HTTP server keeps old session ID after login, enabling session hijack"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["embedded-http-server", "other", "session-management"]
not_affected_if: ["network-access-blocked-from-untrusted-clients"]
published_at: "2026-11-10T16:17:27+00:00"
first_seen_at: "2026-11-10T16:22:36+00:00"
updated_at: "2026-11-10T16:23:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97890", "first_seen_at": "2026-11-10T16:22:36+00:00"}]
exploit_sources: []
---

# Embedded HTTP server keeps old session ID after login, enabling session hijack

Link for people: https://infrastack.ai/live/CVE-2026-97890 (this .md is for agents)

The embedded HTTP server does not invalidate the previous session identifier when an application changes the session ID, such as after login. An attacker who can plant a session ID in a victim's browser can take over that victim's authenticated session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T16:22:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97890

## From the sources

The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_