CVE-2026-111257
— UNSCOREDPublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Weaknesses
CWE-1392
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2026-100103
- CRITICALCVE-2026-108263PoC
- HIGHCVE-2026-108783PoC
- CRITICALCVE-2026-111329PoC
- CRITICALCVE-2026-111693PoC
- CRITICALCVE-2026-111998PoC
- CRITICALCVE-2026-112296PoC
- CRITICALCVE-2026-112354
Related by shared AI tags and CWE weakness class. Browse the full archive.