Threats affecting pkg:maven/org.apache.tomee/tomee-security

Apache TomEE's Jakarta Security identity store backed by the Tomcat user database has a vulnerability where it compares supplied passwords to stored values as plain text, ignoring the configured credential handler. This allows authentication using stored password digests instead of the actual password. The issue is fixed in versions 10.3.0 and 11.0.0-M2.

Apache TomEE's Jakarta Security OpenID Connect authentication mechanism used a non-cryptographic pseudo-random number generator to create state and nonce values, resulting in insufficient entropy. This weakness allows a remote attacker to predict these values and forge authentication callbacks, potentially logging victims into attacker-controlled accounts and weakening ID token replay protection. The issue is fixed in versions 10.3.0 and 11.0.0-M2.

Apache TomEE's Jakarta Security LDAP identity store improperly accepts empty passwords as valid if the directory server allows unauthenticated binds, which some directory servers do by default. This flaw allows a remote attacker to authenticate as any existing user without knowing their password. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.

CVE-2026-111262 is an LDAP Injection vulnerability in the Jakarta Security LDAP identity store component of Apache TomEE. It occurs because special characters in the caller name are not neutralized before being used in LDAP directory queries. This flaw allows a remote unauthenticated attacker to manipulate LDAP queries to enumerate accounts, infer directory attribute values, or affect login validation. The issue affects only applications using the LDAP identity store. Upgrading to Apache TomEE versions 10.3.0 or 11.0.0-M2 resolves the vulnerability.