CVE-2026-87861: cross-origin reuse of a Negotiate connection

Published Oct 20, 2026

Updated

When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.

Event History

Oct 20, 2026

CVE Published

via MITRE·08:09 PM

Data Sourced

via MITRE·08:09 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

Description

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments are exposed when HTTP requests use ambient user credentials and Negotiate authentication, and a request for one origin can be dispatched on a connection previously authenticated for another origin.

What credential context is used for an affected request?

The request may be sent over the previously Negotiate-authenticated connection for the other origin. Its intended credentials are left unused.

CVE-2026-87861: cross-origin reuse of a Negotiate connection

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What credential context is used for an affected request?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What credential context is used for an affected request?