CVE-2026-111242 | BDVDB-2026-402950 Detail

Description#

When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated requests served by the same thread to invoke enterprise beans with the elevated run-as identity. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-10Record published in the CVE List.