CVE-2026-92609
Received Received - Intake

Session Fixation in Apache Qpid Broker-J

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: Apache Software Foundation

Description
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-92609
EUVD
EUVD-2026-86581

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache qpid_broker_j to 10.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-384 Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a session fixation issue in HTTP management authentication for Apache Qpid Broker-J. It allows remote attackers to gain unauthorized access to an authenticated management session by reusing a session identifier that remains valid even after successful authentication.

Impact Analysis

An attacker could exploit this to take control of the management interface, potentially altering configurations, accessing sensitive data, or disrupting services. Systems running affected versions (through 10.1.0) are at risk.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized access to authenticated management sessions. Session fixation risks expose sensitive data to attackers, which may lead to breaches of confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade Apache Qpid Broker-J to version 10.1.1 or later to fix the session fixation vulnerability in HTTP management authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart