CVE-2026-111259: Apache TomEE: Predictable HTTP session identifiers in embedded server
Published Nov 10, 2026
·Updated
The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache TomEEto a version that resolves this vulnerability.Fixed in 10.3.0 - Upgrade
Upgrade
Apache TomEEto a version that resolves this vulnerability.Fixed in 11.0.0-M2
Event History
Nov 10, 2026
CVE Published
via MITRE·03:18 PM
Data Sourced
via MITRE·03:18 PM
DescriptionWeakness