CVE-2026-92609— Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
Quick assessment
Affected
Apache Software Foundation Apache Qpid Broker-J
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HTTP管理认证中的会话固定漏洞允许远程攻击者通过重用成功登录后保留的会话标识符，获得对已认证管理会话的未授权访问。 此问题影响 Apache Qpid Broker-J：版本 10.1.0 及之前版本。 建议用户升级至版本 10.1.1，该版本已修复此问题。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92609
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
Source: CVE Program / CVE List V5
Vulnerability Description
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
会话固定
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Qpid Broker-J | 0 ~ 10.1.0 | - |
|
II. Public POCs for CVE-2026-92609
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92609
请登录查看更多情报信息。
Other References for CVE-2026-92609 (1)
Same Patch Batch · Apache Software Foundation · 2026-09-25 · 6 CVEs total
| CVE-2026-92550 | Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authen | |
| CVE-2026-92560 | Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authen | |
| CVE-2026-92573 | Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression | |
| CVE-2026-92564 | Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication | |
| CVE-2026-92608 | Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10 |
IV. Related Vulnerabilities
Same product: Apache Qpid Broker-J
-
CVE-2026-92550
Apache Qpid Broker-J: Type size/count handling can lead to e -
CVE-2026-92560
Apache Qpid Broker-J: Type size/count handling can lead to e -
CVE-2026-92573
Apache Qpid Broker-J: Uncontrolled resource consumption duri -
CVE-2026-92564
Apache Qpid Broker-J: Unbounded type nesting can lead to sta -
CVE-2026-92608
Apache Qpid Broker-J: Incomplete property conversion handlin
Same vendor: Apache Software Foundation
-
CVE-2026-91006
Apache Karaf: OS Command Injection in Child-Instance Launch -
CVE-2026-90979
Apache Karaf: LDAP filter injection in JAAS LDAP login modul -
CVE-2026-86507
Apache Roller: Stored XSS in comment moderation via comment -
CVE-2026-82379
Apache Roller: WSSE digest authentication headers can be rep -
CVE-2026-82380
Apache Roller: CSRF protection bypass via self-generated sal
Same weakness: CWE-384
-
CVE-2026-57179
social-auth-core has a Session Fixation issue -
CVE-2026-95828
Mstfakts College-Management-System Authentication server.php -
CVE-2026-82355
Apache Airflow: Session cookie silently overrides explicit A -
CVE-2026-81181
SysReptor: Session Fixation in Password-Protected Shared Not -
CVE-2026-86688
Session id is not renewed on authentication in ash_authentic
V. Comments for CVE-2026-92609
No comments yet