Description

Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-25T08:16:41.203Z",
  "pubdate": "2026-09-25T08:16:41.203Z",
  "executiveSummary": "A session fixation vulnerability has been identified in the Apache Qpid Broker-J management interface, affecting versions up to 10.1.0.\nThe vulnerability occurs because the application fails to rotate or regenerate the session identifier upon a successful authentication event. This allows a remote, unauthenticated attacker to inject or pre-determine a session identifier and hijack the resulting authenticated session.\nThe primary impact of this flaw is unauthorized access to the management interface, potentially allowing an attacker to perform administrative actions with the privileges of the hijacked user session.\nThis vulnerability is critical in environments where management interfaces are exposed to the network. Exploitation is achievable by a remote attacker capable of inducing a victim to use a known session identifier or by capturing a pre-authentication session token.\nThe risk implication involves full compromise of the broker's administrative control plane. Users are strongly advised to upgrade to version 10.1.1 to implement mandatory session ID regeneration following authentication.",
  "technicalDetails": "The vulnerability resides within the session management implementation of the Apache Qpid Broker-J management interface. Session fixation is a classic flaw where an application fails to invalidate an existing session identifier or issue a new one after a privilege level change—specifically, the transition from an unauthenticated state to an authenticated state.\nIn the context of Apache Qpid Broker-J, the system maintains the same session identifier (typically stored in a cookie or browser-based local storage) across the entire session lifecycle, including the authentication handshake. This lack of session renewal creates a predictable state for the management session.\nThe attack flow generally proceeds as follows: 1. The attacker initializes a connection to the Apache Qpid Broker-J management interface, obtaining a legitimate but unauthenticated session identifier from the server. 2. The attacker then leverages social engineering or other vectors to induce an administrative user to access the management interface using the attacker-supplied session identifier (e.g., by embedding the ID in a crafted link or via cross-site scripting if available). 3. The administrative user provides their credentials and successfully authenticates. 4. Because the server does not issue a new session token, the authenticated session remains associated with the previously known (and attacker-controlled) identifier. 5. The attacker, possessing the identifier, now assumes the authenticated state and gains unauthorized access to the management console with administrative privileges.\nThe vulnerable component is the HTTP management interface, which fails to enforce secure session lifecycle management practices. This flaw affects all versions of Apache Qpid Broker-J through 10.1.0. The vulnerability is network-accessible and does not require local system access, provided the attacker can reach the management interface. Post-exploitation impact includes unauthorized configuration changes, potential message manipulation, and the ability to manage system resources as an administrative entity. The lack of cryptographic binding between the session ID and the authenticated user identity enables this persistence of the session token throughout the authentication process."
}