CVE-2026-47360

Summary

The flaw allows session cookies to be passed to backend servers even when they should be removed during internal redirects, potentially exposing sensitive session data to unauthorized actors. This affects Apache HTTP Server versions 2.4.0 through 2.4.68.

Exploitability

Exploitation requires an internal redirect scenario where SessionCookieRemove is configured, but the vulnerability is relatively easy to trigger in environments with session-based authentication and internal redirects.

Blast radius

The impact could be significant in web applications that rely on session cookies for authentication and authorization, potentially exposing session tokens to backend services that shouldn't have access to them.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache HTTP Server 2.4.69 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.