CVE-2026-111240

Not scored yetLast modified Nov 12, 2026

Description

The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Apache Software Foundation	Apache TomEE	>= 4.0.0-beta-1, <= 4.7.5
Apache Software Foundation	Apache TomEE	>= 7.0.0-M1, < 10.0.0-M1; >= 10.0.0-M1, < 10.3.0; >= 11.0.0-M1, < 11.0.0-M2

References

https://lists.apache.org/thread/1w1olwsbzpsj7mnv8v3vj30ohq0t0c52

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-111241When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in CVE-2026-111242When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is no CVE-2026-111243A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. CVE-2026-111244When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: res CVE-2026-111245After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request co CVE-2026-111246The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in CVE-2026-111247When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the role CVE-2026-111248The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text an CVE-2026-111249The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any CVE-2026-111258.8Use after free in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox v CVE-2026-111250The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remo CVE-2026-111251The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to conne