CVE-2026-92609: Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Qpid Broker-Jto a version that resolves this vulnerability.Fixed in 10.1.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Apache Qpid Broker-J deployments using HTTP management authentication are exposed if they run version 10.1.0 or an earlier affected release.
What must an attacker do to exploit it?
The attacker must obtain or retain a valid HTTP management session identifier and reuse it after the associated user successfully authenticates. The vulnerability results from the session identifier not being renewed after authentication.
What version fixes the issue?
Upgrade Apache Qpid Broker-J to version 10.1.1, which renews the HTTP session handling affected by this issue.