CVE-2026-111242 · Runtime
NO FIX YET · SEE WHAT TO DO
When MicroProfile JWT authentication is used with servlets that declare a run-as identity, a request that does not finish normally can leave its elevated security identity on the processing thread. A remote attacker with a valid token can then make later, unrelated requests on that thread call enterprise beans with the elevated run-as identity.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use MicroProfile JWT authentication on servlets that declare a run-as identity are exposed, because the elevated identity can persist across requests on a shared thread. Applications without MicroProfile JWT or without run-as servlets are likely not affected. The sources do not name the affected product line or the exact vulnerable version ranges.
Not affected if no-microprofile-jwt, no-run-as-servlets
Who cares java-ee, jwt, microprofile, servlet
@RunAs.10.3.0 or 11.0.0-M2, per the source's statement.When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated requests served by the same thread to invoke enterprise beans with the elevated run-as identity. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.