CVE-2026-111243: Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skew

Published Nov 10, 2026

Updated

A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 10.3.0

Event History

Nov 10, 2026

CVE Published

via MITRE·03:29 PM

Data Sourced

via MITRE·03:29 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Only deployments configured with a negative MicroProfile JWT clock skew setting are described as affected. In that configuration, expiration and other time-based JWT claim validation is disabled.

What does an attacker need to exploit it?

An attacker needs possession of an expired JWT token. They can use that token to authenticate while the negative clock skew configuration remains in place.

What should teams do if they cannot upgrade immediately?

Ensure the MicroProfile JWT clock skew setting is not negative. This prevents the configuration condition that disables expiration and other time-based claim validation.

How can administrators determine whether they may be affected?

Review the MicroProfile JWT clock skew configuration for negative values. Also treat previously expired tokens as potentially usable if the application has been running with a negative setting.

Which releases contain the fix?

The issue is fixed in Apache TomEE version 10.3.0 and 11.0.0-M2.

CVE-2026-111243: Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skew

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What should teams do if they cannot upgrade immediately?

How can administrators determine whether they may be affected?

Which releases contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What should teams do if they cannot upgrade immediately?

How can administrators determine whether they may be affected?

Which releases contain the fix?