CVE-2026-87755 - Vulnerability Details - OpenCVE

Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache TomEE

unaffected

Version	Status	Constraints
`4.0.0-beta-1`	affected	≤ 4.7.5

Apache Software Foundation

Apache TomEE

unaffected

Version	Status	Constraints
`7.0.0-M1`	affected	< 10.0.0-M1
`10.0.0-M1`	affected	< 10.3.0
`11.0.0-M1`	affected	< 11.0.0-M2

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://lists.apache.org/thread.html/srzp26oyjtb3bwgxwsyhpphv778s17m8

History

Tue, 10 Nov 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Title		Apache TomEE: Stateful session bean hijacking via predictable session identifiers
Weaknesses		CWE-340
References		https://lists.apache.org/thread.html/srzp26oyjtb3bwgxwsyhpphv778s17m8

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2026-11-10T14:56:29.818Z

Updated: 2026-11-10T14:56:29.818Z

Reserved: 2026-09-09T07:01:32.622Z

Link: CVE-2026-87755

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-10T15:17:30.483

Modified: 2026-11-10T15:17:30.483

Link: CVE-2026-87755

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-340

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-87755", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-09T07:01:32.622Z", "datePublished": "2026-11-10T14:56:29.818Z", "dateUpdated": "2026-11-10T14:56:29.818Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-10T14:56:29.818Z"}, "title": "Apache TomEE: Stateful session bean hijacking via predictable session identifiers", "problemTypes": [{"descriptions": [{"description": "CWE-340 Generation of Predictable Numbers or Identifiers", "lang": "en", "cweId": "CWE-340", "type": "CWE"}]}], "source": {"discovery": "INTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache TomEE", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.openejb:openejb-core", "packageURL": "pkg:maven/org.apache.openejb/openejb-core", "versions": [{"status": "affected", "version": "4.0.0-beta-1", "lessThanOrEqual": "4.7.5", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache TomEE", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.tomee:openejb-core", "packageURL": "pkg:maven/org.apache.tomee/openejb-core", "versions": [{"status": "affected", "version": "7.0.0-M1", "lessThan": "10.0.0-M1", "versionType": "semver"}, {"status": "affected", "version": "10.0.0-M1", "lessThan": "10.3.0", "versionType": "semver"}, {"status": "affected", "version": "11.0.0-M1", "lessThan": "11.0.0-M2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}]}], "references": [{"url": "https://lists.apache.org/thread.html/srzp26oyjtb3bwgxwsyhpphv778s17m8", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "The Apache Software Foundation", "type": "finder"}, {"lang": "en", "value": "Claude Security", "type": "tool"}, {"lang": "en", "value": "Markus Jung", "type": "remediation developer"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}}}