Description
When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without credentials. Only deployments that use the embedded HTTP server and rely on such an authentication method are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
Metrics
No CVSS score has been published yet.
Weakness enumeration
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache TomEE | >= 4.0.0-beta-1, <= 4.7.5 |
| Apache Software Foundation | Apache TomEE | >= 4.6.0, <= 4.7.5 |
| Apache Software Foundation | Apache TomEE | >= 7.0.0-M1, < 10.0.0-M1; >= 10.0.0-M1, <= 10.2.0; 11.0.0-M1 |
| Apache Software Foundation | Apache TomEE | >= 7.0.0-M1, < 10.0.0-M1; >= 10.0.0-M1, <= 10.2.0; 11.0.0-M1 |
References
Timeline
- Published
- Nov 10, 2026
- Last modified
- Nov 12, 2026
- NVD status
- Awaiting Analysis