17 matches found
CVE-2026-111244
When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass shar...
CVE-2026-111242
When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated...
EUVD-2026-121250
When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated...
CVE-2026-111242 Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identity
When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated...
CVE-2026-111242
Apache TomEE is vulnerable to privilege escalation when using MicroProfile JWT authentication for servlets that declare a run-as identity . The root cause is that the security state from a request is not consistently cleared from the processing thread if a request fails to complete normally. This...
CVE-2026-111243
In Apache TomEE , a vulnerability exists where a negative MicroProfile JWT clock skew setting is not rejected, effectively disabling the validation of token expiration and other time-based claims. This allows an attacker possessing an expired token to successfully authenticate. Remediation is ava...
CVE-2026-111243 Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skew
A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or...
CVE-2026-111244 Apache TomEE: Authorization bypass in MicroProfile JWT role checks for JAX-RS resources
When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass shar...
EUVD-2026-121247
When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass shar...
CVE-2026-111244
In Apache TomEE , a vulnerability exists in MicroProfile JWT role-based access control where JAX-RS resource constraints are not consistently enforced. Specifically, resources declaring an empty set of allowed roles are accessible to all callers, resource classes inheriting methods from a common ...
CVE-2026-111243: Apache Software Foundation Apache TomEE: A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and…
A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or...
CVE-2026-111242: Apache Software Foundation Apache TomEE: When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state…
When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated...
PT-2026-141767
When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated...
PT-2026-141769
When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass shar...
CVE-2026-111244: Apache Software Foundation Apache TomEE: When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always…
When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass shar...
com.zeroz4j:zerozstack-server-helidon (>=0.4.0, <=0.11.0), io.helidon.microprofile.bundles:helidon-microprofile (>=4.0.0, <=4.5.5) +5 more potentially affected by CVE-2026-101590 via io.helidon.microprofile:helidon-microprofile-security (>=4.0.0, <=4.5.5)
io.helidon.microprofile:helidon-microprofile-security MAVEN version =4.0.0, =0.4.0, =4.0.0, =4.0.0, =4.0.0, =4.0.9, =0.0.1, =0.0.1, =0.0.4 Source cves: CVE-2026-101590 Source advisory: MEND:CVE-2026-101590...
io.helidon.microprofile.bundles:helidon-microprofile (>=4.1.2, <=4.5.4), io.helidon.microprofile.jwt:helidon-microprofile-jwt-auth (>=4.1.2, <=4.5.4) +2 more potentially affected by CVE-2026-83488 via io.helidon.microprofile:helidon-microprofile-security (>=4.1.2, <=4.5.4)
io.helidon.microprofile:helidon-microprofile-security MAVEN version =4.1.2, =4.1.2, =4.1.2, =4.1.2, =4.1.2, =4.5.4 Source cves: CVE-2026-83488 Source advisory: MEND:CVE-2026-83488...