Threats affecting pkg:maven/org.apache.tomee/openejb-cxf

CVE-2026-111245 is a vulnerability in Apache TomEE where after successful WS-Security UsernameToken authentication, the authenticated identity remains associated with the worker thread after request completion. This allows a remote unauthenticated attacker to reuse the thread and invoke protected EJB methods with the identity of a previously authenticated user. The issue affects multiple versions of Apache TomEE prior to fixed releases. Upgrading to versions 10.3.0 or 11.0.0-M2 resolves the vulnerability.