{"id":"CVE-2026-118489","published":"2026-11-03T15:17:24.780","lastModified":"2026-11-03T19:17:55.877","description":"In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and not marked `private`/`no-store` is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response. Depending on the response this discloses authenticated content or a session cookie, the latter enabling session fixation or hijacking.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-200","CWE-524"],"vendors":[],"products":[],"references":[{"url":"https://github.com/vert-x3/vertx-web/security/advisories/GHSA-xh2g-9hw9-mvp3","tags":[]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/523","tags":[]}],"exploitRefs":[{"url":"https://github.com/vert-x3/vertx-web/security/advisories/GHSA-xh2g-9hw9-mvp3","tags":[]}],"hasPoc":true,"ai":null}