CVE-2026-111260

Not scored yetLast modified Nov 12, 2026

Description

The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker's account, and the replay protection for ID tokens is weakened. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-338

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Apache Software Foundation	Apache TomEE	>= 10.0.0-M2, < 10.3.0; >= 11.0.0-M1, < 11.0.0-M2

References

https://lists.apache.org/thread/y6oscfyggkdf5hrj518nl08v7l8rr40q

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-111261The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some CVE-2026-111262The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A r CVE-2026-111263Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published withi CVE-2026-111264The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthen CVE-2026-1112696.1libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding in CVE-2026-111276.5Inappropriate implementation in WebAPKs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain spoof CVE-2026-1112706.1libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never chec CVE-2026-1112715.5libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows CVE-2026-1112725.5LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short S CVE-2026-1112736.1unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_g CVE-2026-1112745.5unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra CVE-2026-1112756.1nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2