{"api_version":"1","generated_at":"2026-11-11T06:15:15+00:00","cve":"CVE-2026-111250","urls":{"html":"https://cve.report/CVE-2026-111250","api":"https://cve.report/api/cve/CVE-2026-111250.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-111250","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-111250"},"summary":{"title":"Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP server","description":"The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.","state":"PUBLISHED","assigner":"apache","published_at":"2026-11-10 16:17:15","updated_at":"2026-11-10 16:17:15"},"problem_types":["CWE-287","CWE-287 CWE-287 Improper Authentication"],"metrics":[],"references":[{"url":"https://lists.apache.org/thread/yr5sbbmyym2zfoho8qv3yxshoztqjk6k","name":"https://lists.apache.org/thread/yr5sbbmyym2zfoho8qv3yxshoztqjk6k","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111250","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111250","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 4.0.0-beta-1 4.7.5 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 7.0.0-M1 10.0.0-M1 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 10.0.0-M1 10.2.0 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 11.0.0-M1 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"The Apache Software Foundation","lang":"en"},{"source":"CNA","value":"Claude Security","lang":"en"},{"source":"CNA","value":"Richard Zowalla","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-http","packageURL":"pkg:maven/org.apache.openejb/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-http","packageURL":"pkg:maven/org.apache.tomee/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"The Apache Software Foundation"},{"lang":"en","type":"tool","value":"Claude Security"},{"lang":"en","type":"remediation developer","value":"Richard Zowalla"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"value":"The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"metrics":[{"other":{"content":{"text":"moderate"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","description":"CWE-287 Improper Authentication","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-10T15:21:32.361Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/yr5sbbmyym2zfoho8qv3yxshoztqjk6k"}],"source":{"discovery":"INTERNAL"},"title":"Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP server","x_generator":{"engine":"Vulnogram 1.0.3"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-111250","datePublished":"2026-11-10T15:21:32.361Z","dateReserved":"2026-10-15T18:36:39.888Z","dateUpdated":"2026-11-10T15:21:32.361Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-10 16:17:15","lastModifiedDate":"2026-11-10 16:17:15","problem_types":["CWE-287","CWE-287 CWE-287 Improper Authentication"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"111250","Ordinal":"1","Title":"Apache TomEE: Authentication bypass via programmatic authenticat","CVE":"CVE-2026-111250","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"111250","Ordinal":"1","NoteData":"The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.","Type":"Description","Title":"Apache TomEE: Authentication bypass via programmatic authenticat"}]}}}