CVE-2026-92609
published 2026-09-25CVE-2026-92609: Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a…
PriorityP264critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.46%
39.5th percentile
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | qpid_broker-j | < 10.1.1 | 10.1.1 |
| apache_software_foundation | apache_qpid_broker-j | <= 10.1.0 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Qpid Broker-J session fixiation
vuldb·2026-09-25
CVE-2026-92609 [CRITICAL] Apache Qpid Broker-J session fixiation
A vulnerability was found in Apache Qpid Broker-J and classified as critical. The impacted element is an unknown function. The manipulation results in session fixiation.
This vulnerability is reported as CVE-2026-92609. The attack can be launched remotely. No exploit exists.
GHSA
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successf
ghsa_unreviewed·2026-09-25
CVE-2026-92609 [CRITICAL] CWE-384 Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successf
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
Red Hat
apache-qpid-broker-j: org.apache.qpid/qpid-broker-plugins-management-http: Apache Qpid Broker-J: Unauthorized management session access via session fixation
vendor_redhat·2026-09-25·CVSS 9.8
CVE-2026-92609 [CRITICAL] CWE-613 apache-qpid-broker-j: org.apache.qpid/qpid-broker-plugins-management-http: Apache Qpid Broker-J: Unauthorized management session access via session fixation
apache-qpid-broker-j: org.apache.qpid/qpid-broker-plugins-management-http: Apache Qpid Broker-J: Unauthorized management session access via session fixation
A flaw was found in Apache Qpid Broker-J. The application does not renew session identifiers upon successful authentication, leading to a session fixation vulnerability in the HTTP management interface. A remote attacker can exploit this issue by establishing a session identifier prior to login and reusing it after a legitimate user authenticates. This allows an attacker to hijack the authenticated management session and perform unauthorized administrative actions.
Statement: This vulnerability is rated as Important because unauthorized actors can hijack legitimate administrative sessions to gain elevated control over the message bro
No detection rules found.
No public exploits indexed.
2026-09-25
Published