Exposed Session Identifiers in Apache's EJB Remote Endpoint

CVE-2026-87755

What is CVE-2026-87755?

The vulnerability arises from the insecure generation of stateful session bean identifiers in Apache's EJB remote endpoint. A remote attacker with access to the EJB remote endpoint can exploit this flaw by using a valid session identifier to derive identifiers of other users' sessions. This enables the attacker to invoke methods on those clients' beans, potentially exposing or modifying sensitive session data. To mitigate this risk, it is crucial to upgrade to version 10.3.0 or 11.0.0-M2, which address this issue.

References