CVE-2026-111264 - Vulnerability Details - OpenCVE

The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache TomEE

unaffected

Version	Status	Constraints
`4.0.0-beta-1`	affected	≤ 4.0.0
`1.5.0`	affected	≤ 1.7.5

Apache Software Foundation

Apache TomEE

unaffected

Version	Status	Constraints
`7.0.0-M1`	affected	< 10.0.0-M1
`10.0.0-M1`	affected	< 10.3.0
`11.0.0-M1`	affected	< 11.0.0-M2

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://lists.apache.org/thread.html/tldxh492p71z2rlw7g4l1vplrxo5n116

History

Tue, 10 Nov 2026 15:15:00 +0000

Type	Values Removed	Values Added
Description		The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Title		Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method
Weaknesses		CWE-288
References		https://lists.apache.org/thread.html/tldxh492p71z2rlw7g4l1vplrxo5n116

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2026-11-10T15:04:30.755Z

Updated: 2026-11-10T15:04:30.755Z

Reserved: 2026-10-15T18:59:34.903Z

Link: CVE-2026-111264

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-10T15:17:12.253

Modified: 2026-11-10T15:17:12.253

Link: CVE-2026-111264

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-288

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111264", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-15T18:59:34.903Z", "datePublished": "2026-11-10T15:04:30.755Z", "dateUpdated": "2026-11-10T15:04:30.755Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-10T15:04:30.755Z"}, "title": "Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method", "problemTypes": [{"descriptions": [{"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "lang": "en", "cweId": "CWE-288", "type": "CWE"}]}], "source": {"discovery": "INTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache TomEE", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.openejb:tomee-webservices", "packageURL": "pkg:maven/org.apache.openejb/tomee-webservices", "versions": [{"status": "affected", "version": "4.0.0-beta-1", "lessThanOrEqual": "4.0.0", "versionType": "semver"}, {"status": "affected", "version": "1.5.0", "lessThanOrEqual": "1.7.5", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache TomEE", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.tomee:tomee-webservices", "packageURL": "pkg:maven/org.apache.tomee/tomee-webservices", "versions": [{"status": "affected", "version": "7.0.0-M1", "lessThan": "10.0.0-M1", "versionType": "semver"}, {"status": "affected", "version": "10.0.0-M1", "lessThan": "10.3.0", "versionType": "semver"}, {"status": "affected", "version": "11.0.0-M1", "lessThan": "11.0.0-M2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}]}], "references": [{"url": "https://lists.apache.org/thread.html/tldxh492p71z2rlw7g4l1vplrxo5n116", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "The Apache Software Foundation", "type": "finder"}, {"lang": "en", "value": "Claude Security", "type": "tool"}, {"lang": "en", "value": "Jonathan Gallimore", "type": "remediation developer"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}}}