PT-2026-141737

CVE-2026-111259

·

Published

2026-11-10

·

Updated

2026-11-10

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Researchers
Vendors
Affected products
Weakness enumeration
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Related identifiers
CVE-2026-111259
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com