org.apache.tomee/mp-jwt vulnerabilities

Latest org.apache.tomee/mp-jwt CVEs

Newest publication first

1. CVE-2026-111242 Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identity

   Published 2026-11-10

   Unknown EPSS 0.23%

   When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause l...

2. CVE-2026-111243 Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skew

   Published 2026-11-10

   Unknown EPSS 0.14%

   A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to ve...

3. CVE-2026-111244 Apache TomEE: Authorization bypass in MicroProfile JWT role checks for JAX-RS resources

   Published 2026-11-10

   Unknown EPSS 0.22%

   When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a commo...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.