{"api_version":"1","generated_at":"2026-11-10T15:49:12+00:00","cve":"CVE-2026-87755","urls":{"html":"https://cve.report/CVE-2026-87755","api":"https://cve.report/api/cve/CVE-2026-87755.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-87755","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-87755"},"summary":{"title":"Apache TomEE: Stateful session bean hijacking via predictable session identifiers","description":"Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","state":"PUBLISHED","assigner":"apache","published_at":"2026-11-10 15:17:30","updated_at":"2026-11-10 15:17:30"},"problem_types":["CWE-340","CWE-340 CWE-340 Generation of Predictable Numbers or Identifiers"],"metrics":[],"references":[{"url":"https://lists.apache.org/thread.html/srzp26oyjtb3bwgxwsyhpphv778s17m8","name":"https://lists.apache.org/thread.html/srzp26oyjtb3bwgxwsyhpphv778s17m8","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87755","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87755","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 4.0.0-beta-1 4.7.5 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 7.0.0-M1 10.0.0-M1 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 10.0.0-M1 10.3.0 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 11.0.0-M1 11.0.0-M2 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"The Apache Software Foundation","lang":"en"},{"source":"CNA","value":"Claude Security","lang":"en"},{"source":"CNA","value":"Markus Jung","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-core","packageURL":"pkg:maven/org.apache.openejb/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-core","packageURL":"pkg:maven/org.apache.tomee/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"The Apache Software Foundation"},{"lang":"en","type":"tool","value":"Claude Security"},{"lang":"en","type":"remediation developer","value":"Markus Jung"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"value":"Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"metrics":[{"other":{"content":{"text":"moderate"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-340","description":"CWE-340 Generation of Predictable Numbers or Identifiers","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-10T14:56:29.818Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/srzp26oyjtb3bwgxwsyhpphv778s17m8"}],"source":{"discovery":"INTERNAL"},"title":"Apache TomEE: Stateful session bean hijacking via predictable session identifiers","x_generator":{"engine":"Vulnogram 1.0.3"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-87755","datePublished":"2026-11-10T14:56:29.818Z","dateReserved":"2026-09-09T07:01:32.622Z","dateUpdated":"2026-11-10T14:56:29.818Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-10 15:17:30","lastModifiedDate":"2026-11-10 15:17:30","problem_types":["CWE-340","CWE-340 CWE-340 Generation of Predictable Numbers or Identifiers"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"87755","Ordinal":"1","Title":"Apache TomEE: Stateful session bean hijacking via predictable se","CVE":"CVE-2026-87755","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"87755","Ordinal":"1","NoteData":"Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","Type":"Description","Title":"Apache TomEE: Stateful session bean hijacking via predictable se"}]}}}