OpenEJB HTTP Server Vulnerability Allows Unauthorized Access to EJB Methods

CVE-2026-111245

What is CVE-2026-111245?

In the OpenEJB HTTP server, after successful WS-Security UsernameToken authentication, the identity of the authenticated caller remains linked to the worker thread post-request completion. This flaw enables a remote unauthenticated attacker to exploit subsequent requests processed on the same thread, allowing unauthorized invocation of protected EJB methods under the context of a previously authenticated user. Users are strongly advised to upgrade to versions 10.3.0 or 11.0.0-M2 to mitigate this security risk.

References