---
id: "CVE-2026-111250"
page: "https://infrastack.ai/live/CVE-2026-111250"
kind: "vulnerability"
aliases: ["CVE-2026-111250"]
title: "OpenEJB: embedded HTTP server treats every request as authenticated"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "openejb", "package", "self-hosted", "tomee"]
not_affected_if: ["declarative-auth", "no-untrusted-network-access", "tomee-distribution"]
published_at: "2026-11-10T16:17:15+00:00"
first_seen_at: "2026-11-10T16:22:33+00:00"
updated_at: "2026-11-10T16:24:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111250", "first_seen_at": "2026-11-10T16:22:33+00:00"}]
exploit_sources: []
---

# OpenEJB: embedded HTTP server treats every request as authenticated

Link for people: https://infrastack.ai/live/CVE-2026-111250 (this .md is for agents)

The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote attacker without credentials can reach functionality that the application meant to protect.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for applications that run the embedded OpenEJB HTTP server (not the Tomcat-based TomEE distributions).
- Check whether those applications use programmatic authentication for protected endpoints.
- Check whether the embedded HTTP server is reachable from untrusted networks.

## Fix

- No fixed version is stated in the sources. Recommended: block network access to the embedded HTTP server from untrusted clients, or migrate to the Tomcat-based TomEE distributions.

## Timeline

- 2026-11-10T16:22:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111250

## From the sources

The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_