CVE-2026-47360
Received Received - Intake

Session Cookie Exposure in Apache HTTP Server mod_session_cookie

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Apache Software Foundation

Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.   When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-47360
EUVD
EUVD-2026-90891

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache http_server From 2.4.0 (inc) to 2.4.68 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes during internal redirects, the session cookie may still be passed to a backend server, potentially exposing sensitive information to unauthorized actors.

Detection Guidance

This vulnerability involves the Apache HTTP Server's mod_session_cookie module where session cookies may be exposed during internal redirects if SessionCookieRemove changes. Detection requires checking Apache HTTP Server versions between 2.4.0 and 2.4.68. Inspect server configuration files for mod_session_cookie usage and review logs for session cookie exposure during redirects.

Impact Analysis

An attacker could exploit this to access sensitive session data, leading to unauthorized access to user accounts or confidential information. This could result in data breaches or privacy violations.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (health information privacy) due to unauthorized exposure of sensitive data. Organizations may face legal penalties or reputational damage.

Mitigation Strategies

Upgrade Apache HTTP Server to a version beyond 2.4.68 to address the vulnerability in mod_session_cookie.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47360. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart