CVE-2026-111261: Apache TomEE: Authentication bypass with empty password in LDAP identity store

Published Nov 10, 2026

Updated

The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can then authenticate as any existing user without knowing the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 10.3.0
Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 11.0.0-M2

Event History

Nov 10, 2026

CVE Published

via MITRE·03:14 PM

Data Sourced

via MITRE·03:14 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the Jakarta Security LDAP identity store are exposed if their directory server permits unauthenticated binds. Some directory servers allow unauthenticated binds by default.

What does an attacker need to exploit the bypass?

An attacker needs network access to the affected authentication endpoint and the username of an existing user. They can authenticate as that user by supplying an empty password.

How can the issue be remediated?

Upgrade Apache TomEE to version 10.3.0 or 11.0.0-M2, which fix the issue.

CVE-2026-111261: Apache TomEE: Authentication bypass with empty password in LDAP identity store

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the bypass?

How can the issue be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the bypass?

How can the issue be remediated?