{"id":"CVE-2026-47360","published":"2026-10-01T16:17:44.443","lastModified":"2026-10-02T20:57:52.130","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.\n\n\n\n   \nWhen SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.\n\n\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-200"],"vendors":["apache"],"products":["http server"],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/14","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows session cookies to be passed to backend servers even when they should be removed during internal redirects, potentially exposing sensitive session data to unauthorized actors. This affects Apache HTTP Server versions 2.4.0 through 2.4.68.","exploitability":"Exploitation requires an internal redirect scenario where SessionCookieRemove is configured, but the vulnerability is relatively easy to trigger in environments with session-based authentication and internal redirects.","blast_radius":"The impact could be significant in web applications that rely on session cookies for authentication and authorization, potentially exposing session tokens to backend services that shouldn't have access to them.","remediation":"Upgrade to Apache HTTP Server 2.4.69 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["session","cookie","information-disclosure"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:05:08.213Z"}}