CVE-2026-111242
— UNSCOREDPublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated requests served by the same thread to invoke enterprise beans with the elevated run-as identity. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Weaknesses
CWE-488
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-103544PoC
- MEDIUMCVE-2026-103868
- MEDIUMCVE-2026-103869
- UNSCOREDCVE-2026-111245
- UNSCOREDCVE-2026-112921PoC
- HIGHCVE-2026-114637PoC
- HIGHCVE-2026-115419PoC
- MEDIUMCVE-2026-120634PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.