Remote Authentication Bypass in OpenEJB HTTP Server by Apache

CVE-2026-97880

What is CVE-2026-97880?

A vulnerability has been identified within the embedded OpenEJB HTTP server, where certain requests to REST endpoints configured for HTTP Basic authentication are processed without proper credential verification. This oversight allows remote unauthenticated attackers to access and invoke protected resources, circumventing the intended authentication mechanisms. Deployments utilizing the embedded HTTP server with Basic authentication are specifically vulnerable. It is advisable for users to restrict network access to the embedded HTTP server from untrusted clients and consider migrating to TomEE distributions based on Tomcat for enhanced security features.

References