Authentication Flaw in MicroProfile JWT for Servlet Processing by Apache

CVE-2026-111242

What is CVE-2026-111242?

A flaw in MicroProfile JWT authentication allows a remote attacker with a valid token to exploit the run-as identity feature. When servlets declare a run-as identity, remnants of the security context may persist in the processing thread even after incomplete request handling, resulting in unintended elevation of privileges for subsequent requests. This vulnerability can lead to unauthorized access to enterprise beans, which poses a significant security risk. Users are urged to upgrade to corrected versions 10.3.0 or 11.0.0-M2 to mitigate this issue.

References