CVE-2026-111264 PUBLISHED

Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method

Assigner: apache
Reserved: 15.10.2026 Published: 10.11.2026 Updated: 10.11.2026

The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Product Status

Vendor Apache Software Foundation
Product Apache TomEE
Versions Default: unaffected
  • affected from 4.0.0-beta-1 to 4.0.0 (incl.)
  • affected from 1.5.0 to 1.7.5 (incl.)
Vendor Apache Software Foundation
Product Apache TomEE
Versions Default: unaffected
  • affected from 7.0.0-M1 to 10.0.0-M1 (excl.)
  • affected from 10.0.0-M1 to 10.3.0 (excl.)
  • affected from 11.0.0-M1 to 11.0.0-M2 (excl.)

Credits

  • The Apache Software Foundation finder
  • Claude Security tool
  • Jonathan Gallimore remediation developer

References

Problem Types

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel CWE