CVE-2026-111245
— UNSCOREDPublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same thread can invoke protected EJB methods with the identity of a previously authenticated user. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Weaknesses
CWE-488
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-103544PoC
- MEDIUMCVE-2026-103868
- MEDIUMCVE-2026-103869
- UNSCOREDCVE-2026-111242
- UNSCOREDCVE-2026-112921PoC
- HIGHCVE-2026-114637PoC
- HIGHCVE-2026-115419PoC
- MEDIUMCVE-2026-120634PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.