Threats affecting pkg:maven/org.apache.openejb/openejb-hessian

Apache TomEE versions using the embedded HTTP server to serve Hessian remoting endpoints silently ignore configured authentication and transport security. This allows remote unauthenticated attackers to invoke exposed EJB methods without credentials or encryption. The issue affects deployments relying on the embedded HTTP server rather than Tomcat. Users should block network access to Hessian endpoints from untrusted clients or migrate to a different remoting protocol.

Apache TomEE versions using the Hessian protocol to expose EJBs may silently bypass configured authentication and transport security settings, allowing remote unauthenticated attackers to invoke exposed EJB methods. This affects deployments that use the Hessian module with such configurations. Users are advised to restrict network access to Hessian endpoints or migrate to other remoting protocols. A fix is available starting from version 10.0.0-M1.

CVE-2026-97874 is an improper authentication vulnerability in Apache TomEE when using Hessian remoting with BASIC authentication. The authentication check is bypassed for Hessian endpoints of applications deployed under a non-root context path, allowing remote unauthenticated attackers to invoke exposed EJB methods without credentials. Users are advised to restrict network access to these endpoints or migrate to a different remoting protocol.