This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-87755 | BDVDB-2026-402925 Detail

ApacheApache TomEE

Description#

Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Impact#

No impact statement in the source data.

Weaknesses#

  • CWE-340 Generation of Predictable Numbers or Identifiers

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.