A vulnerability in EJB JAX-WS endpoints with configured authentication allows remote unauthenticated attackers to bypass authentication by using HTTP methods not protected by the security constraint. The issue is fixed in versions 10.3.0 and 11.0.0-M2.