CVE-2026-111240 Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module

The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user...

CVE-2026-111240

The Apache TomEE JDBC based JAAS login module contains an authentication bypass vulnerability. The issue arises because the module accepts logins without a password for accounts where the stored password is NULL in the SQL login module. A remote attacker who knows the username of such an account ...