CVE-2026-111250

Not scored yetLast modified Nov 12, 2026

Description

The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Apache Software Foundation	Apache TomEE	>= 4.0.0-beta-1, <= 4.7.5
Apache Software Foundation	Apache TomEE	>= 7.0.0-M1, < 10.0.0-M1; >= 10.0.0-M1, <= 10.2.0; 11.0.0-M1

References

https://lists.apache.org/thread/yr5sbbmyym2zfoho8qv3yxshoztqjk6k

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-111251The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to conne CVE-2026-1112526.5A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without CVE-2026-1112536.6A flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the un CVE-2026-1112547.2The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and CVE-2026-1112557.5The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all CVE-2026-111256When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods CVE-2026-111257With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-kno CVE-2026-111258The optional request routing feature forwards requests to their configured destination without applying the security constraints of that des CVE-2026-111259The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who ob CVE-2026-111264.3Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malic CVE-2026-111260The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number gen CVE-2026-111261The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some