Authentication Bypass Vulnerability in Hessian Remoting - Apache

CVE-2026-97874

What is CVE-2026-97874?

Hessian remoting, when implemented with BASIC authentication, suffers from a vulnerability where the authentication mechanism is not enforced for endpoints situated in non-root context paths. This oversight enables a remote attacker, devoid of any credential requirements, to invoke enterprise JavaBeans (EJB) methods that should otherwise be protected. It is strongly advised that users restrict network access to Hessian endpoints from untrusted sources and consider transitioning to an alternative remoting protocol to mitigate potential risks.

References