CVE-2026-111256

When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without...

EUVD-2026-121225

When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without...

CVE-2026-111256

The Apache TomEE web server is vulnerable to a missing authentication flaw (CWE-306) when using JAX-WS or JAX-RS endpoints published by the embedded OpenEJB HTTP server instead of Tomcat. In affected configurations, specific authentication methods are silently ignored, allowing a remote unauthent...

CVE-2026-111256 Apache TomEE: Missing authentication for web service endpoints in embedded HTTP server

When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without...

CVE-2026-111263

Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the application protects the endpoint with its...

CVE-2026-111264

The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, whi...

CVE-2026-111263 Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web application

Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the application protects the endpoint with its...

CVE-2026-111263

Apache TomEE contains a vulnerability where authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when published within an existing web application. This allows a remote unauthenticated attacker to invoke web service operations unless the applicat...

EUVD-2026-121218

Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the application protects the endpoint with its...

EUVD-2026-121217

The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, whi...

CVE-2026-111264: Apache Software Foundation Apache TomEE: The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP…

The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, whi...

CVE-2026-111256: Apache Software Foundation Apache TomEE: When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured…

When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without...

PT-2026-141734

When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without...

CVE-2026-111263: Apache Software Foundation Apache TomEE: Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the…

Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the application protects the endpoint with its...

PT-2026-141741

Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the application protects the endpoint with its...

PT-2026-141742

The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, whi...

CVE-2019-2890

Disclaimer For learning and communication purposes only. Use for other purposes at your own risk. Description The relevant jar files have been imported into the project, and the exploitation method uses yso's JRMP. When learning and debugging, you can modify the exploitation method. First, place...

asf__cxf_CVE-2016-6812_3-0-11

Welcome to Apache CXF! Apache CXF is an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. These services can speak a variety of protocols such as SOAP, XML/HTTP, RESTful HTTP, or CORBA and work over a variety of...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities due to Apache CXF (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary There are mulitple vulnerabilities in the Apache CXF library that affect IBM WebSphere Application Server and affect WebSphere Application Server Liberty when the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, or xmlWS-4.0 features are enabled. Vulnerability Details CVEID:CVE-2026-57819...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by an authentication bypass vulnerability (CVE-2026-10845)

Summary IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by an authentication bypass vulnerability when a JAX-WS application is deployed. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected...