CVE-2026-111242
Received Received - Intake

MicroProfile JWT Authentication Security State Persistence Flaw

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: Apache Software Foundation

Description
When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated requests served by the same thread to invoke enterprise beans with the elevated run-as identity. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-111242
EUVD
EUVD-2026-121250

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache microprofile_jwt 10.3.0
apache microprofile_jwt 11.0.0-m2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-488 The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves MicroProfile JWT authentication for servlets with run-as identity. When a request fails to complete normally, the security state isn't cleared from the processing thread. This allows a remote attacker with a valid token to manipulate later requests served by the same thread, causing them to execute with elevated privileges.

Impact Analysis

An attacker could gain unauthorized access to sensitive operations by exploiting this flaw. This may lead to data breaches, privilege escalation, or unauthorized actions within the application, depending on the privileges of the run-as identity.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, violating compliance requirements such as GDPR (data protection) or HIPAA (health information security). It may result in legal penalties, loss of trust, and failure to meet regulatory standards.

Mitigation Strategies

Upgrade to MicroProfile JWT version 10.3.0 or 11.0.0-M2 to fix the issue. Review servlet configurations using run-as identity to ensure proper security state handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111242. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...