UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-111259
The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Properties
- Last source
- NVD
- Nvd fetched at
- 2026-11-10T23:33:48.924589+00:00
- Cve id
- CVE-2026-111259
- First seen by Signal
- 2026-11-10T19:28:55+00:00
- Retrieved at
- 2026-11-10T23:34:23+00:00
- Published at
- 2026-11-10T16:17:16.590
- Last modified
- 2026-11-10T16:17:16.590
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph