{"id":"CVE-2026-111260","kind":"vulnerability","aliases":["CVE-2026-111260"],"related":[],"title":"Jakarta Security OpenID Connect: predictable state and nonce allow forged login callbacks","description":"The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker's account, and the replay protection for ID tokens is weakened. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"The Jakarta Security OpenID Connect authentication mechanism generates its state and nonce values with a non-cryptographic random number generator and too little entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker's account, and ID token replay protection is weakened.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jakarta-ee","java","openid-connect","package"],"not_affected_if":["not-using-openid-connect","other-auth-mechanism"],"how_to_check":"- Check the Jakarta Security OpenID Connect dependency version in the project build file (for example `pom.xml` or `build.gradle`) and see whether it is below `10.3.0` or `11.0.0-M2`\n- Confirm whether the application uses the Jakarta Security OpenID Connect authentication mechanism for login","fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, which the sources state fix the issue","status":"open","published_at":"2026-11-10T16:17:16+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","triaged_at":"2026-11-10T16:24:03+00:00","updated_at":"2026-11-10T16:24:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T16:24:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, which the sources state fix the issue","reach":"internet","title":"Jakarta Security OpenID Connect: predictable state and nonce allow forged login callbacks","impact":"medium","summary":"The Jakarta Security OpenID Connect authentication mechanism generates its state and nonce values with a non-cryptographic random number generator and too little entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker's account, and ID token replay protection is weakened.","audience":"developers","category":"package","nicknames":[],"who_cares":["jakarta-ee","java","openid-connect"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker logs victims into attacker-controlled accounts via forged callbacks","analyst_note":"","how_to_check":"- Check the Jakarta Security OpenID Connect dependency version in the project build file (for example `pom.xml` or `build.gradle`) and see whether it is below `10.3.0` or `11.0.0-M2`\n- Confirm whether the application uses the Jakarta Security OpenID Connect authentication mechanism for login","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["not-using-openid-connect","other-auth-mechanism"],"who_is_affected":"Applications that use the Jakarta Security OpenID Connect authentication mechanism for sign-in on a Jakarta EE server. Applications that do not use this mechanism, or that use a different login method, are not exposed through this flaw.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000762,"input_tokens":4585,"output_tokens":607,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111260':15A,18A '-2026':14A,17A '10.3.0':141C '11.0.0':143C 'account':72B,124C 'allow':9A 'attack':54B,70B,106C,122C 'authent':32B,62B,85C,114C 'callback':12A,63B,115C 'connect':4A,25B,31B,84C 'cryptograph':44B,97C 'cve':13A,16A 'ee':21B 'entropi':51B,103C 'fix':146C 'forg':10A,60B,112C 'generat':34B,47B,87C,100C 'id':74B,130C 'insuffici':102C 'issu':148C 'jakarta':1A,20B,28B,81C 'jakarta-e':19B 'java':22B 'littl':50B 'log':65B,117C 'login':11A 'm2':144C 'mechan':33B,86C 'non':43B,96C 'non-cryptograph':42B,95C 'nonc':8A,38B,91C 'number':46B,99C 'openid':3A,24B,30B,83C 'openid-connect':23B 'packag':26B 'predict':5A,56B,108C 'protect':77B,128C 'random':45B,98C 'recommend':136C 'remot':53B,105C 'replay':76B,127C 'secur':2A,29B,82C 'state':6A,36B,89C 'token':75B,131C 'upgrad':138C 'user':134C 'valu':39B,58B,92C,110C 'version':140C 'victim':67B,119C 'weaken':79B,133C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Jakarta Security OpenID Connect authentication mechanism for sign-in on a Jakarta EE server. Applications that do not use this mechanism, or that use a different login method, are not exposed through this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","jakartaee","java","openidconnect","package"],"campaign_type":null,"search_a":"'-111260':15A,18A '-2026':14A,17A 'allow':9A 'callback':12A 'connect':4A 'cve':13A,16A 'forg':10A 'jakarta':1A 'login':11A 'nonc':8A 'openid':3A 'predict':5A 'secur':2A 'state':6A","search_b":"'account':72B 'attack':54B,70B 'authent':32B,62B 'callback':63B 'connect':25B,31B 'cryptograph':44B 'ee':21B 'entropi':51B 'forg':60B 'generat':34B,47B 'id':74B 'jakarta':20B,28B 'jakarta-e':19B 'java':22B 'littl':50B 'log':65B 'mechan':33B 'non':43B 'non-cryptograph':42B 'nonc':38B 'number':46B 'openid':24B,30B 'openid-connect':23B 'packag':26B 'predict':56B 'protect':77B 'random':45B 'remot':53B 'replay':76B 'secur':29B 'state':36B 'token':75B 'valu':39B,58B 'victim':67B 'weaken':79B","search_c":"'10.3.0':141C '11.0.0':143C 'account':124C 'attack':106C,122C 'authent':85C,114C 'callback':115C 'connect':84C 'cryptograph':97C 'entropi':103C 'fix':146C 'forg':112C 'generat':87C,100C 'id':130C 'insuffici':102C 'issu':148C 'jakarta':81C 'log':117C 'm2':144C 'mechan':86C 'non':96C 'non-cryptograph':95C 'nonc':91C 'number':99C 'openid':83C 'predict':108C 'protect':128C 'random':98C 'recommend':136C 'remot':105C 'replay':127C 'secur':82C 'state':89C 'token':131C 'upgrad':138C 'user':134C 'valu':92C,110C 'version':140C 'victim':119C 'weaken':133C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111260","severity":null,"published_at":"2026-11-10T16:17:16+00:00","modified_at":"2026-11-10T16:17:16+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","fetched_at":"2026-11-10T16:22:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}