OPENEJB · CVE-2026-111246 · Runtime
NO FIX YET
The embedded OpenEJB HTTP server does not keep HTTP sessions separate between web applications it hosts. A remote attacker can reuse a session from one web application inside another, which trusts session state the first application set.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only deployments that host several web applications on the embedded OpenEJB HTTP server are affected, according to the description. Single-application deployments are not described as affected. The sources recommend blocking network access to the embedded HTTP server from untrusted clients, or migrating to the Tomcat-based TomEE distributions.
Not affected if single-web-application, tomcat-based-tomee
Who cares java, openejb, self-hosted, tomee
Unknown from the sources.
The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web application in another one, which then trusts session state set by the first application. Only deployments hosting several web applications on the embedded HTTP server are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.