56 matches found
CVE-2026-111244
When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass shar...
CVE-2026-111243
A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or...
CVE-2026-111242
When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated...
EUVD-2026-121250
When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated...
CVE-2026-111242 Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identity
When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated...
CVE-2026-111242
Apache TomEE is vulnerable to privilege escalation when using MicroProfile JWT authentication for servlets that declare a run-as identity . The root cause is that the security state from a request is not consistently cleared from the processing thread if a request fails to complete normally. This...
CVE-2026-111243
In Apache TomEE , a vulnerability exists where a negative MicroProfile JWT clock skew setting is not rejected, effectively disabling the validation of token expiration and other time-based claims. This allows an attacker possessing an expired token to successfully authenticate. Remediation is ava...
EUVD-2026-121249
A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or...
CVE-2026-111243 Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skew
A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or...
CVE-2026-111244 Apache TomEE: Authorization bypass in MicroProfile JWT role checks for JAX-RS resources
When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass shar...
EUVD-2026-121247
When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass shar...
CVE-2026-111244
In Apache TomEE , a vulnerability exists in MicroProfile JWT role-based access control where JAX-RS resource constraints are not consistently enforced. Specifically, resources declaring an empty set of allowed roles are accessible to all callers, resource classes inheriting methods from a common ...
CVE-2026-111243: Apache Software Foundation Apache TomEE: A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and…
A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or...
CVE-2026-111242: Apache Software Foundation Apache TomEE: When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state…
When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated...
CVE-2026-111244: Apache Software Foundation Apache TomEE: When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always…
When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass shar...
PT-2026-141769
When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass shar...
PT-2026-141767
When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated...
PT-2026-141768
A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or...
payara__Payara_CVE-2022-37422_5-2022-2
Payara Platform Community Edition Create. Innovate. Elevate. Payara Platform Community Edition features open source server runtimes for development projects and containerized Jakarta EE and MicroProfile applications. Payara Server Community is a cloud-native, innovative open source middleware...
EUVD-2026-105998
Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-microprofile-security. Supported versions that are affected are 4.0.0-4.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks ...