Apache TomEE contains a vulnerability where the remote EJB client does not verify that the server's hostname matches the TLS certificate. This allows an attacker intercepting network traffic to impersonate the server and potentially read or modify sensitive data including credentials and invocation information. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.