CVE-2026-111240: fallo en Apache TomEE
Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 0.2%
The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Productos afectados
Apache Software Foundation · Apache TomEECVEs relacionadas — Apache TomEE
En el mismo producto, de las más peligrosas a las menos.
CVE-2018-8031—CVE-2018-8031EPSS 2.0%CVE-2026-111264—Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP methodEPSS 0.3%CVE-2026-111263—Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web applicationEPSS 0.2%CVE-2026-111242—Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identityEPSS 0.2%CVE-2026-111250—Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP serverEPSS 0.2%CVE-2026-97880—Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authenticationEPSS 0.2%