Apache TomEE's standalone OpenEJB server admin service accepts unauthenticated stop requests by default on the loopback interface, allowing any local user or process to stop the server and cause denial of service. This issue affects multiple versions prior to 10.3.0 and 11.0.0-M2, where it has been fixed.