Apache TomEE versions using the embedded OpenEJB HTTP server to publish JAX-WS or JAX-RS endpoints may silently ignore configured authentication methods, resulting in endpoints exposed without authentication. This allows remote unauthenticated attackers to invoke operations without credentials. The issue affects deployments relying on the embedded HTTP server with such authentication methods. Users are advised to block network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions.