OPENEJB-HTTP · CVE-2026-97880 · Package
NO FIX YET
Apache says the embedded OpenEJB HTTP server dispatches some requests to Basic-auth-protected REST endpoints without verifying credentials, so a remote unauthenticated attacker can reach protected resources. The advisory (severity moderate) names no fixed version; it recommends blocking untrusted network access to the embedded server or migrating to Tomcat-based TomEE.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Apps that run the embedded OpenEJB HTTP server (the openejb-http artifact) with HTTP Basic authentication on REST endpoints are exposed: a remote unauthenticated client can call those protected resources. The Apache advisory lists org.apache.openejb:openejb-http 4.0.0-beta-1 to 4.7.5 and org.apache.tomee:openejb-http 7.0.0-M1 to 10.2.0 plus 11.0.0-M1. Deployments on the Tomcat-based TomEE distributions, or without Basic auth, can skip it.
Not affected if no-basic-auth, no-embedded-http-server, tomcat-based-tomee, tomee-distribution
Who cares auth-bypass, basic-auth, java, openejb, rest, tomee
The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with Basic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Unknown from the sources.