cve-2025-66723

CVE-2025-66723: inMusic Brands Engine DJ =3.0.0 through =3.0.0, 4.3.4, on all platforms macOS, Windows. Specifically tested versions found affected/vulnerable, macOS and Windows: 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.2.0, 3.3.0, 3.4.0, 4.0.0, 4.0.1, 4.1.0, 4.2.0, 4.2.1, 4.3.0 Specifically tested versions...

CVE-2026-97888

The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request. A remote unauthenticated attacker can have their request processed with the identity of a previously authenticated user, gaining that user's privileges. On...

CVE-2026-97890

The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network...

CVE-2026-97870

When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments...

CVE-2026-97880

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...

CVE-2026-111256

When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without...

CVE-2026-111250

The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic...

CVE-2026-86531

The Apache TomEE embedded OpenEJB HTTP server is vulnerable to a Denial of Service (DoS) attack because it lacks limits on the size of incoming request bodies and multipart requests. Additionally, it fails to remove temporary files created during multipart processing. A remote unauthenticated att...

CVE-2026-86531 Apache TomEE: DoS via unbounded request body and multipart handling in embedded HTTP server

The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deploymen...

EUVD-2026-121158

When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments...

CVE-2026-97870

When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments...

CVE-2026-97870

Apache TomEE is vulnerable to a missing authentication flaw in its embedded HTTP server when serving Hessian remoting endpoints. The vulnerability occurs because configured authentication and transport security requirements are silently ignored, allowing a remote unauthenticated attacker to invok...

CVE-2026-97870 Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server

When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments...

CVE-2026-97880

The embedded OpenEJB HTTP server in Apache TomEE is vulnerable to an authentication bypass affecting REST endpoints configured with HTTP Basic authentication . The root cause is that the server dispatches certain requests to these endpoints without verifying credentials. A remote unauthenticated ...

EUVD-2026-121261

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...

CVE-2026-97880 Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authentication

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...

CVE-2026-97881 Apache TomEE: Path traversal in embedded HTTP server static resource handling

The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted...

CVE-2026-97881

The embedded OpenEJB HTTP server in Apache TomEE is vulnerable to a path traversal flaw (CWE-22) due to a failure to restrict static resource paths to configured directories. A remote unauthenticated attacker can exploit this to read arbitrary files accessible to the server process. To mitigate t...

EUVD-2026-121258

The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request. A remote unauthenticated attacker can have their request processed with the identity of a previously authenticated user, gaining that user's privileges. On...

CVE-2026-97888 Apache TomEE: Caller identity leaks across requests in embedded HTTP server

The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request. A remote unauthenticated attacker can have their request processed with the identity of a previously authenticated user, gaining that user's privileges. On...