This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-111260 | BDVDB-2026-402964 Detail

ApacheApache TomEE

Description#

The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker's account, and the replay protection for ID tokens is weakened. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Impact#

No impact statement in the source data.

Weaknesses#

  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.