{"id":"CVE-2026-97880","kind":"vulnerability","aliases":["CVE-2026-97880"],"related":[],"title":"Apache TomEE: embedded OpenEJB HTTP server skips Basic auth on some REST endpoints","description":"The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with Basic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.","summary":"Apache says the embedded OpenEJB HTTP server dispatches some requests to Basic-auth-protected REST endpoints without verifying credentials, so a remote unauthenticated attacker can reach protected resources. The advisory (severity moderate) names no fixed version; it recommends blocking untrusted network access to the embedded server or migrating to Tomcat-based TomEE.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"openejb-http","fixed":[],"affected":">= 4.0.0-beta-1, <= 4.7.5","ecosystem":"maven"},{"name":"org.apache.tomee:openejb-http","fixed":[],"affected":">= 7.0.0-M1, <= 10.2.0","ecosystem":"maven"},{"name":"org.apache.tomee:openejb-http 11","fixed":[],"affected":"11.0.0-M1","ecosystem":"maven"}],"ecosystems":[],"tags":["auth-bypass","basic-auth","java","openejb","package","rest","tomee"],"not_affected_if":["no-basic-auth","no-embedded-http-server","tomcat-based-tomee","tomee-distribution"],"how_to_check":"- Look for the openejb-http dependency (org.apache.openejb or org.apache.tomee) in your pom/build files, e.g. mvn dependency:tree | grep openejb-http, and compare with the affected versions.\n- Check whether you start the embedded OpenEJB HTTP server (not the Tomcat-based TomEE distribution) and protect REST endpoints with HTTP Basic auth.\n- Workaround from Apache: block network access to the embedded HTTP server from untrusted clients, or migrate to the Tomcat-based TomEE distributions.","fix":null,"status":"open","published_at":"2026-11-10T16:17:26+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","triaged_at":"2026-11-10T16:23:52+00:00","updated_at":"2026-11-10T16:25:14+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T16:23:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OpenEJB: embedded HTTP server skips Basic auth on some REST endpoints","impact":"high","summary":"The embedded OpenEJB HTTP server sends some requests to REST endpoints configured for HTTP Basic authentication without checking credentials. A remote attacker with no account can call protected resources and bypass authentication.","audience":"developers","category":"package","nicknames":[],"who_cares":["openejb","java","rest","basic-auth"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker invokes protected REST resources without credentials.","analyst_note":"Confirm affected OpenEJB versions and the fixed release from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-97880); no fix is stated in the sources.","how_to_check":"- Check whether the application runs OpenEJB's embedded HTTP server (not the Tomcat-based TomEE distribution) with HTTP Basic authentication configured on REST endpoints.\n- Search the deployment configuration for Basic auth settings on REST resources.","plain_action":"","product_name":"org.apache.openejb:openejb-server","needs_analyst":true,"not_affected_if":["tomee-distribution","no-basic-auth","no-embedded-http-server"],"who_is_affected":"Only deployments that use OpenEJB's embedded HTTP server with Basic authentication are affected. Teams running the Tomcat-based TomEE distributions are not described as affected. The sources say the recommended workaround is to block network access to the embedded HTTP server from untrusted clients or to migrate to TomEE.","user_interaction":"no","product_ecosystem":"maven","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000778,"input_tokens":4606,"output_tokens":635,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm affected OpenEJB versions and the fixed release from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-97880); no fix is stated in the sources.","search":"'-2026':15A,18A '-97880':16A,19A '11':31A 'access':85B,145C 'advisori':73B 'affect':138C 'apach':1A,43B 'attack':67B,119C 'auth':9A,33B,37B,56B 'auth-bypass':32B 'authent':112C,125C,136C 'base':95B,160C 'basic':8A,36B,55B,111C,135C 'basic-auth':35B 'basic-auth-protect':54B 'block':82B,143C 'bypass':34B,124C 'client':153C 'configur':108C 'credenti':62B,115C 'cve':14A,17A 'deploy':127C 'dispatch':50B,102C 'distribut':162C 'embed':3A,46B,88B,98C,131C,148C 'endpoint':13A,59B,107C 'fix':78B 'http':5A,22A,26A,30A,48B,100C,110C,132C,149C 'invok':121C 'java':38B 'migrat':91B,156C 'moder':75B 'name':76B 'network':84B,144C 'openejb':4A,21A,25A,29A,39B,47B,99C 'openejb-http':20A,24A,28A 'org.apache.tomee':23A,27A 'packag':40B 'protect':57B,70B,122C 'reach':69B 'recommend':81B,141C 'remot':65B,117C 'request':52B,104C 'resourc':71B,123C 'rest':12A,41B,58B,106C 'say':44B 'server':6A,49B,89B,101C,133C,150C 'sever':74B 'skip':7A 'tomcat':94B,159C 'tomcat-bas':93B 'tome':2A,42B,96B,161C 'unauthent':66B,118C 'untrust':83B,152C 'use':129C 'user':139C 'verifi':61B,114C 'version':79B 'without':60B,113C","nicknames":[],"mitigations":[],"who_affected":"Apps that run the embedded OpenEJB HTTP server (the openejb-http artifact) with HTTP Basic authentication on REST endpoints are exposed: a remote unauthenticated client can call those protected resources. The Apache advisory lists org.apache.openejb:openejb-http 4.0.0-beta-1 to 4.7.5 and org.apache.tomee:openejb-http 7.0.0-M1 to 10.2.0 plus 11.0.0-M1. Deployments on the Tomcat-based TomEE distributions, or without Basic auth, can skip it.","tier":"B","verified":{"products":{"at":"2026-11-10T16:25:14Z","by":"analyst","doc":"https://lists.apache.org/thread/fm51rhyqmjv2b9hphro608thj4yr4ngx","run_id":2465},"who_affected":{"at":"2026-11-10T16:25:14Z","by":"analyst","doc":"https://lists.apache.org/thread/fm51rhyqmjv2b9hphro608thj4yr4ngx","run_id":2465}},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":["openejbhttp","orgapachetomeeopenejbhttp","orgapachetomeeopenejbhttp11"],"ptokens":["11","apache","http","openejb","org","tomee"],"labels":["authbypass","basicauth","high","java","openejb","package","rest","tomee"],"campaign_type":null,"search_a":"'-2026':15A,18A '-97880':16A,19A '11':31A 'apach':1A 'auth':9A 'basic':8A 'cve':14A,17A 'embed':3A 'endpoint':13A 'http':5A,22A,26A,30A 'openejb':4A,21A,25A,29A 'openejb-http':20A,24A,28A 'org.apache.tomee':23A,27A 'rest':12A 'server':6A 'skip':7A 'tome':2A","search_b":"'access':85B 'advisori':73B 'apach':43B 'attack':67B 'auth':33B,37B,56B 'auth-bypass':32B 'base':95B 'basic':36B,55B 'basic-auth':35B 'basic-auth-protect':54B 'block':82B 'bypass':34B 'credenti':62B 'dispatch':50B 'embed':46B,88B 'endpoint':59B 'fix':78B 'http':48B 'java':38B 'migrat':91B 'moder':75B 'name':76B 'network':84B 'openejb':39B,47B 'packag':40B 'protect':57B,70B 'reach':69B 'recommend':81B 'remot':65B 'request':52B 'resourc':71B 'rest':41B,58B 'say':44B 'server':49B,89B 'sever':74B 'tomcat':94B 'tomcat-bas':93B 'tome':42B,96B 'unauthent':66B 'untrust':83B 'verifi':61B 'version':79B 'without':60B","search_c":"'access':145C 'affect':138C 'attack':119C 'authent':112C,125C,136C 'base':160C 'basic':111C,135C 'block':143C 'bypass':124C 'client':153C 'configur':108C 'credenti':115C 'deploy':127C 'dispatch':102C 'distribut':162C 'embed':98C,131C,148C 'endpoint':107C 'http':100C,110C,132C,149C 'invok':121C 'migrat':156C 'network':144C 'openejb':99C 'protect':122C 'recommend':141C 'remot':117C 'request':104C 'resourc':123C 'rest':106C 'server':101C,133C,150C 'tomcat':159C 'tome':161C 'unauthent':118C 'untrust':152C 'use':129C 'user':139C 'verifi':114C 'without':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97880","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97880","severity":null,"published_at":"2026-11-10T16:17:26+00:00","modified_at":"2026-11-10T16:17:26+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","fetched_at":"2026-11-10T16:22:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97880:2465","url":"https://lists.apache.org/thread/fm51rhyqmjv2b9hphro608thj4yr4ngx","severity":null,"published_at":"2026-11-10T16:25:14+00:00","modified_at":"2026-11-10T16:25:14+00:00","first_seen_at":"2026-11-10T16:25:14+00:00","fetched_at":"2026-11-10T16:25:14+00:00","note":"Read Apache TomEE users@ advisory (primary): affected ranges, workaround only; no fixed version stated. Title changed from OpenEJB to TomEE naming. web-cli not used; NVD page had no extra data. Vendor severity moderate; left high unchanged pending CVSS.","cites":["https://lists.apache.org/thread/fm51rhyqmjv2b9hphro608thj4yr4ngx"]}],"documents":[{"id":116249,"url":"https://lists.apache.org/thread/fm51rhyqmjv2b9hphro608thj4yr4ngx","title":"CVE-2026-97880: Apache TomEE: Authentication bypass in the embedded HTTP server (users@tomee)","kind":"advisory","source":"analyst","publisher":null,"text":"Severity: moderate. Affected: org.apache.openejb:openejb-http 4.0.0-beta-1 through 4.7.5; org.apache.tomee:openejb-http 7.0.0-M1 before 10.0.0-M1; 10.0.0-M1 through 10.2.0; 11.0.0-M1. The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. Only deployments using the embedded HTTP server with Basic auth are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions. Credit: ASF (finder), Claude Security (tool), Markus Jung (remediation developer). No fixed version stated.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}