---
id: "CVE-2026-97880"
page: "https://infrastack.ai/live/CVE-2026-97880"
kind: "vulnerability"
aliases: ["CVE-2026-97880"]
title: "Apache TomEE: embedded OpenEJB HTTP server skips Basic auth on some REST endpoints"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "openejb-http", "fixed": [], "affected": ">= 4.0.0-beta-1, <= 4.7.5", "ecosystem": "maven"}, {"name": "org.apache.tomee:openejb-http", "fixed": [], "affected": ">= 7.0.0-M1, <= 10.2.0", "ecosystem": "maven"}, {"name": "org.apache.tomee:openejb-http 11", "fixed": [], "affected": "11.0.0-M1", "ecosystem": "maven"}]
ecosystems: []
tags: ["auth-bypass", "basic-auth", "java", "openejb", "package", "rest", "tomee"]
not_affected_if: ["no-basic-auth", "no-embedded-http-server", "tomcat-based-tomee", "tomee-distribution"]
published_at: "2026-11-10T16:17:26+00:00"
first_seen_at: "2026-11-10T16:22:35+00:00"
updated_at: "2026-11-10T16:25:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97880", "first_seen_at": "2026-11-10T16:22:35+00:00"}, {"source": "analyst", "url": "https://lists.apache.org/thread/fm51rhyqmjv2b9hphro608thj4yr4ngx", "first_seen_at": "2026-11-10T16:25:14+00:00", "cites": ["https://lists.apache.org/thread/fm51rhyqmjv2b9hphro608thj4yr4ngx"]}]
exploit_sources: []
---

# Apache TomEE: embedded OpenEJB HTTP server skips Basic auth on some REST endpoints

Link for people: https://infrastack.ai/live/CVE-2026-97880 (this .md is for agents)

Apache says the embedded OpenEJB HTTP server dispatches some requests to Basic-auth-protected REST endpoints without verifying credentials, so a remote unauthenticated attacker can reach protected resources. The advisory (severity moderate) names no fixed version; it recommends blocking untrusted network access to the embedded server or migrating to Tomcat-based TomEE.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:openejb-http affected >= 4.0.0-beta-1, <= 4.7.5 fixed no fixed version listed
- maven:org.apache.tomee:openejb-http affected >= 7.0.0-M1, <= 10.2.0 fixed no fixed version listed
- maven:org.apache.tomee:openejb-http 11 affected 11.0.0-M1 fixed no fixed version listed

## How to check

- Look for the openejb-http dependency (org.apache.openejb or org.apache.tomee) in your pom/build files, e.g. mvn dependency:tree | grep openejb-http, and compare with the affected versions.
- Check whether you start the embedded OpenEJB HTTP server (not the Tomcat-based TomEE distribution) and protect REST endpoints with HTTP Basic auth.
- Workaround from Apache: block network access to the embedded HTTP server from untrusted clients, or migrate to the Tomcat-based TomEE distributions.

## Timeline

- 2026-11-10T16:22:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97880
- 2026-11-10T16:25:14+00:00 analyst https://lists.apache.org/thread/fm51rhyqmjv2b9hphro608thj4yr4ngx — Read Apache TomEE users@ advisory (primary): affected ranges, workaround only; no fixed version stated. Title changed from OpenEJB to TomEE naming. web-cli not used; NVD page had no extra data. Vendor severity moderate; left high unchanged pending CVSS.

## Documents

- [advisory] CVE-2026-97880: Apache TomEE: Authentication bypass in the embedded HTTP server (users@tomee) https://lists.apache.org/thread/fm51rhyqmjv2b9hphro608thj4yr4ngx

## From the sources

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with Basic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_