Token Authentication Vulnerability in Apache MicroProfile Products

CVE-2026-111243

What is CVE-2026-111243?

A flaw exists in Apache MicroProfile where a negative JWT clock skew setting is not properly validated, leading to potential authentication bypass. This allows attackers to use expired tokens to gain access, undermining the integrity of token expiration checks and time-based claims. It is crucial for users running affected versions to update to the secure versions, 10.3.0 or 11.0.0-M2, to mitigate this issue.

References