Vulnerabilitymedium
CVE-2026-92609: Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
AI summary · grok-4.7Summaries by Vani AI
Apache Qpid Broker-J through 10.1.0 has a session-fixation flaw in HTTP management authentication.
Apache Qpid Broker-J through 10.1.0 fails to renew the HTTP session after successful management authentication. A remote attacker who can fix a session identifier can reuse it to gain unauthorized access to an authenticated management session. The vendor rates the issue important and recommends users upgrade.
Key facts
- Session identifier is not renewed after successful HTTP management login.
- Remote attackers can reuse a pre-auth session ID to hijack a management session.
- Affects Apache Qpid Broker-J through 10.1.0; vendor severity is important.
- CVEs
- CVE-2026-92609
- Vendors
- Apache
- Products
- Apache Qpid Broker-J
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92609 | Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a… | 9.8 | — |
From the original article
Posted by Daniil Kirilyuk on Sep 24 Severity: important Affected versions: - Apache Qpid Broker-J (org. apache. qpid:qpid-broker-plugins-management-http) through 10.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.