Session Hijacking Vulnerability in Apache Tomcat HTTP Server

CVE-2026-97890

What is CVE-2026-97890?

The vulnerability in the Apache Tomcat embedded HTTP server arises from the failure to invalidate an active session identifier when a new session id is generated, such as during user login. This flaw allows attackers to exploit a planted session identifier, potentially leading to unauthorized access to an authenticated session. To mitigate risks, it is advised that users restrict network access to the embedded HTTP server from untrusted clients or consider transitioning to the TomEE distributions based on Tomcat.

References