CVE-2026-111240: Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module

Published Nov 10, 2026

Updated

The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 10.3.0
Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 11.0.0-M2

Event History

Nov 10, 2026

CVE Published

via MITRE·03:30 PM

Data Sourced

via MITRE·03:30 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Only deployments that use the JDBC-based JAAS login module and have accounts whose password value is NULL in the user table are affected. Deployments not using that login module, or without NULL stored passwords, are not identified as affected.

What does an attacker need to exploit the bypass?

A remote attacker needs to know the username of an account with a NULL stored password. They can then authenticate without a password and receive that account's assigned roles.

What should teams do if they cannot upgrade immediately?

Identify accounts with NULL password values in the user table used by the JDBC JAAS login module and remediate those entries so they do not remain NULL. Upgrade to version 10.3.0 or 11.0.0-M2 when possible.

How can I determine whether I may already be affected?

Verify whether the deployment uses the JDBC-based JAAS login module, then inspect its user table for accounts with NULL password values. Any such account may be accessible to an attacker who knows its username.

CVE-2026-111240: Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the bypass?

What should teams do if they cannot upgrade immediately?

How can I determine whether I may already be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the bypass?

What should teams do if they cannot upgrade immediately?

How can I determine whether I may already be affected?