Session Vulnerability in Apache TomEE Products Exposes User Privileges

CVE-2026-97888

What is CVE-2026-97888?

An issue exists in Apache TomEE's embedded HTTP server where the security identity from a prior request is not cleared before processing a new request. This vulnerability allows a remote unauthenticated attacker to leverage the permissions of an authenticated user's session, potentially gaining unauthorized access to sensitive data and functionalities. It primarily affects applications that authenticate programmatically or utilize basic authentication. To mitigate risks, it is advised to restrict access to the embedded HTTP server from untrusted networks or to consider transitioning to the Tomcat-based TomEE distributions.

References