Description
The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Published: 2026-11-10
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 15:15:00 +0000

Type Values Removed Values Added
Description The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Title Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method
Weaknesses CWE-288
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-11-10T15:04:30.755Z

Reserved: 2026-10-15T18:59:34.903Z

Link: CVE-2026-111264

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-10T15:17:12.253

Modified: 2026-11-10T15:17:12.253

Link: CVE-2026-111264

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-288

    Authentication Bypass Using an Alternate Path or Channel