CVE-2026-92609: Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication

As cited

Copy frozen at 2026-09-25 03:53 UTC (site build).

vulnerabilities

CVE-2026-92609: Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication

Apache Qpid Broker-J through version 10.1.0 contains a session fixation vulnerability in its HTTP management interface that allows remote attackers to reuse session identifiers across authentication boundaries. The HTTP session is not renewed after successful authentication, enabling attackers to hijack authenticated management sessions. Versions through 10.1.0 are affected.

Why it matters: Organizations deploying Apache Qpid Broker-J should assess whether the HTTP management interface is exposed and prioritize patching to prevent unauthorized administrative access through session reuse.

Source published

2026-09-24 23:55 UTC

First seen by Cybersecurity Tracker

2026-09-25 00:05 UTC