CVE-2026-111260
Apache TomEE: Predictable OpenID Connect state and nonce values
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker's account, and the replay protection for ID tokens is weakened. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
| CWE | CWE-338 |
| Vendor | apache software foundation |
| Product | apache tomee |
| Published | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache tomee
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache tomee are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache TomEE
10.0.0-M2 < 10.3.0 11.0.0-M1 < 11.0.0-M2
References
Credits
The Apache Software Foundation Claude Security Markus Jung