Threats affecting pkg:maven/org.apache.tomee/openejb-core

Apache TomEE versions from 10.1.1 up to but not including 10.3.0, and from 11.0.0-M1 up to but not including 11.0.0-M2, running on JDK 21 or later, skip EJB method authorization checks. This allows callers to invoke EJB methods without enforcement of configured access restrictions. The issue is fixed in versions 10.3.0 and 11.0.0-M2.

A vulnerability in Apache TomEE's JDBC based JAAS login module allows authentication without a password for accounts with NULL stored passwords. An attacker who knows such a username can authenticate as that user and obtain their roles. This affects deployments using this login module with NULL passwords in the user table. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.

CVE-2026-111241 is a vulnerability in Apache TomEE where passivated stateful session beans are stored in predictably named temporary files in a shared system directory. A local attacker with write access to this directory can read or manipulate these files, potentially causing the server to deserialize malicious data and execute arbitrary code. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.

Apache TomEE versions prior to 10.3.0 and 11.0.0-M2 contain a vulnerability where internal system EJBs used for remote deployment and configuration do not enforce administrative role checks when running with the default profile. This allows a remote unauthenticated attacker who can access the remote EJB endpoint to deploy arbitrary applications and execute code. Only installations with enabled system applications and remote EJB endpoints are affected. Upgrading to versions 10.3.0 or 11.0.0-M2 resolves the issue.

Apache TomEE versions prior to 10.3.0 and 11.0.0-M2 generate stateful session bean identifiers using a non-cryptographically secure random source. This flaw allows a remote attacker with a valid identifier to predict other clients' session identifiers and access or modify their session state. The issue is fixed in versions 10.3.0 and 11.0.0-M2.

Apache TomEE contains a path traversal vulnerability in its stateful session bean passivation mechanism. The on-disk file name used for session state is derived from a client-supplied identifier without proper validation, allowing a remote attacker with access to the remote EJB service to read or write files outside the intended passivation directory. This issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.

Apache TomEE's bundled JAAS login modules have a vulnerability where they leak information about username existence and perform credential comparisons in a non-constant-time manner. This allows a remote unauthenticated attacker to enumerate valid accounts and potentially infer credential material through timing analysis. The issue is fixed in versions 10.3.0 and 11.0.0-M2.