CVE-2026-47360

HIGH · 7.5 CVSS Gepubliceerd: 01-10-2026 CWE-200

Beschrijving

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.

When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.