CVE-2026-111250: vulnerability in Apache TomEE
Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP server
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.2%
The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
Affected products
Apache Software Foundation · Apache TomEERelated CVEs — Apache TomEE
In the same product, most dangerous first.
CVE-2018-8031—CVE-2018-8031EPSS 2.0%CVE-2026-111264—Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP methodEPSS 0.3%CVE-2026-111263—Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web applicationEPSS 0.2%CVE-2026-111242—Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identityEPSS 0.2%CVE-2026-97880—Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authenticationEPSS 0.2%CVE-2026-111245—Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requestsEPSS 0.2%