CVE-2026-97890

Published 10 November 2026 · tracked since 11 November 2026

Description

The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network access

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-125350 HIGH 8.8
• CVE-2026-125349 LOW 3.4
• CVE-2026-125348 HIGH 8.8
• CVE-2026-125347 CRITICAL 9.6
• CVE-2026-125346 HIGH 8.8
• CVE-2026-125345 MEDIUM 4.7
• CVE-2026-125344 HIGH 8.8
• CVE-2026-125343 HIGH 8.3
• CVE-2026-125342 MEDIUM 4.7
• CVE-2026-125326 MEDIUM 5.8

→ Open the live CVE board · all tools