CVE-2026-111264: Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method

Q: Which deployments are exposed to this bypass?

Deployments using EJB JAX-WS endpoints with configured authentication are affected when the generated security constraint protects only some HTTP methods.

Q: What does an attacker need to exploit the issue?

A remote attacker does not need to authenticate. They can bypass authentication by sending a request using an HTTP method that is not protected by the generated security constraint.

Q: What versions address the issue?

Upgrade to Apache TomEE version 10.3.0 or 11.0.0-M2, which fix the issue.

Published Nov 10, 2026

Updated

The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Affected Software

1 affected component

Apache TomEE<10.3.0, <11.0.0-M2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 10.3.0
Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 11.0.0-M2

Event History

Nov 10, 2026

CVE Published

via MITRE·03:04 PM

Data Sourced

via MITRE·03:04 PM

DescriptionWeakness

Data Sourced

via NVD·03:17 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this bypass?

Deployments using EJB JAX-WS endpoints with configured authentication are affected when the generated security constraint protects only some HTTP methods.

What does an attacker need to exploit the issue?

A remote attacker does not need to authenticate. They can bypass authentication by sending a request using an HTTP method that is not protected by the generated security constraint.

What versions address the issue?

Upgrade to Apache TomEE version 10.3.0 or 11.0.0-M2, which fix the issue.

CVE-2026-111264: Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this bypass?

What does an attacker need to exploit the issue?

What versions address the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this bypass?

What does an attacker need to exploit the issue?

What versions address the issue?