{"id":"CVE-2026-111250","kind":"vulnerability","aliases":["CVE-2026-111250"],"related":[],"title":"OpenEJB: embedded HTTP server treats every request as authenticated","description":"The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.","summary":"The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote attacker without credentials can reach functionality that the application meant to protect.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","openejb","package","self-hosted","tomee"],"not_affected_if":["declarative-auth","no-untrusted-network-access","tomee-distribution"],"how_to_check":"- Look for applications that run the embedded OpenEJB HTTP server (not the Tomcat-based TomEE distributions).\n- Check whether those applications use programmatic authentication for protected endpoints.\n- Check whether the embedded HTTP server is reachable from untrusted networks.","fix":"- No fixed version is stated in the sources. Recommended: block network access to the embedded HTTP server from untrusted clients, or migrate to the Tomcat-based TomEE distributions.","status":"open","published_at":"2026-11-10T16:17:15+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","triaged_at":"2026-11-10T16:24:11+00:00","updated_at":"2026-11-10T16:24:11+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T16:24:11Z","model":"claude-haiku-5-5","output":{"fix":"- No fixed version is stated in the sources. Recommended: block network access to the embedded HTTP server from untrusted clients, or migrate to the Tomcat-based TomEE distributions.","reach":"internet","title":"OpenEJB: embedded HTTP server treats every request as authenticated","impact":"high","summary":"The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote attacker without credentials can reach functionality that the application meant to protect.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openejb","tomee","java","self-hosted"],"confidence":0.6,"fix_status":"none","needs_auth":"no","worst_case":"Remote attacker reaches protected functionality without credentials","analyst_note":"Confirm the affected version range and any fixed release from the NVD entry or the OpenEJB project; the sources give no version data.","how_to_check":"- Look for applications that run the embedded OpenEJB HTTP server (not the Tomcat-based TomEE distributions).\n- Check whether those applications use programmatic authentication for protected endpoints.\n- Check whether the embedded HTTP server is reachable from untrusted networks.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["tomee-distribution","declarative-auth","no-untrusted-network-access"],"who_is_affected":"Only applications served by the embedded OpenEJB HTTP server that rely on programmatic authentication are affected. Applications using TomEE distributions or declarative authentication are not described as affected. Teams should check whether the embedded server is exposed to untrusted clients.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4579,"output_tokens":605,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111250':12A,15A '-2026':11A,14A 'access':74C,100C 'affect':93C 'applic':35B,49B,65C,80C 'attack':41B,72C 'authent':9A,32B,37B,62C,67C,91C 'base':115C 'block':98C 'client':108C 'credenti':43B 'cve':10A,13A 'distribut':117C 'embed':2A,24B,54C,84C,103C 'everi':6A,29B,59C 'function':46B,75C 'host':21B 'http':3A,26B,56C,85C,104C 'java':16B 'meant':50B 'migrat':111C 'network':99C 'openejb':1A,17B,25B,55C 'packag':18B 'programmat':38B,68C,90C 'protect':52B,76C 'reach':45B 'recommend':96C 'reli':88C 'remot':40B,70C 'report':28B,58C 'request':7A,30B,36B,60C,66C 'self':20B 'self-host':19B 'serv':81C 'server':4A,27B,57C,86C,105C 'tomcat':114C 'tome':22B,116C 'treat':5A 'unauthent':71C 'untrust':107C 'user':94C 'way':78C 'without':42B","nicknames":[],"mitigations":[],"who_affected":"Only applications served by the embedded OpenEJB HTTP server that rely on programmatic authentication are affected. Applications using TomEE distributions or declarative authentication are not described as affected. Teams should check whether the embedded server is exposed to untrusted clients.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","java","openejb","package","selfhosted","tomee"],"campaign_type":null,"search_a":"'-111250':12A,15A '-2026':11A,14A 'authent':9A 'cve':10A,13A 'embed':2A 'everi':6A 'http':3A 'openejb':1A 'request':7A 'server':4A 'treat':5A","search_b":"'applic':35B,49B 'attack':41B 'authent':32B,37B 'credenti':43B 'embed':24B 'everi':29B 'function':46B 'host':21B 'http':26B 'java':16B 'meant':50B 'openejb':17B,25B 'packag':18B 'programmat':38B 'protect':52B 'reach':45B 'remot':40B 'report':28B 'request':30B,36B 'self':20B 'self-host':19B 'server':27B 'tome':22B 'without':42B","search_c":"'access':74C,100C 'affect':93C 'applic':65C,80C 'attack':72C 'authent':62C,67C,91C 'base':115C 'block':98C 'client':108C 'distribut':117C 'embed':54C,84C,103C 'everi':59C 'function':75C 'http':56C,85C,104C 'migrat':111C 'network':99C 'openejb':55C 'programmat':68C,90C 'protect':76C 'recommend':96C 'reli':88C 'remot':70C 'report':58C 'request':60C,66C 'serv':81C 'server':57C,86C,105C 'tomcat':114C 'tome':116C 'unauthent':71C 'untrust':107C 'user':94C 'way':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111250","severity":null,"published_at":"2026-11-10T16:17:15+00:00","modified_at":"2026-11-10T16:17:15+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","fetched_at":"2026-11-10T16:22:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}