Threats affecting pkg:maven/org.apache.tomee/mp-jwt

Apache TomEE versions prior to 10.3.0 and 11.0.0-M2 have a vulnerability in MicroProfile JWT authentication where the security state for a request is not always cleared from the processing thread if the request does not complete normally. This can allow a remote attacker with a valid token to cause unrelated requests on the same thread to execute with elevated run-as identity privileges. Upgrading to versions 10.3.0 or 11.0.0-M2 mitigates this issue.

Apache TomEE versions 10.0.0-M1 through before 10.3.0 and 11.0.0-M1 through before 11.0.0-M2 contain a vulnerability where a negative MicroProfile JWT clock skew setting disables validation of token expiration and other time-based claims. This allows an attacker possessing an expired token to authenticate successfully. The issue is fixed in versions 10.3.0 and 11.0.0-M2.

CVE-2026-111244 is an authorization vulnerability in Apache TomEE affecting MicroProfile JWT role-based access control. It causes access constraints on JAX-RS resources to be improperly enforced, allowing unauthorized access to resources that should be restricted. This includes cases where resources with empty allowed role sets are accessible to all callers, shared constraints across inherited methods, and ignored superclass-level constraints. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.