{"id":"CVE-2026-111260","aliases":[],"cve":{"records":[{"id":"CVE-2026-111260","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-15T18:59:33.677Z","published":"2026-11-10T15:15:35.099Z","modified":"2026-11-10T15:15:35.099Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-10T15:15:35.099Z"}],"references":[{"url":"https://lists.apache.org/thread/y6oscfyggkdf5hrj518nl08v7l8rr40q","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-338","description":"CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache TomEE: Predictable OpenID Connect state and nonce values","titleSource":"apache","descriptionSource":"apache","description":"The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker's account, and the replay protection for ID tokens is weakened. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","score":null,"severity":"unknown","published":"2026-11-10T15:15:35.099Z","modified":"2026-11-10T15:15:35.099Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"10.0.0-M2","status":"affected","lessThan":"10.3.0","versionType":"semver"},{"version":"11.0.0-M1","status":"affected","lessThan":"11.0.0-M2","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.tomee/tomee-security","packageIdentity":{"ecosystem":"Maven","name":"org.apache.tomee:tomee-security"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-111260"}],"remediation":[],"references":["https://lists.apache.org/thread/y6oscfyggkdf5hrj518nl08v7l8rr40q"],"sources":[{"name":"CVE","id":"CVE-2026-111260","modified":"2026-11-10T15:15:35.099Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-111260"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-10T15:30:29.673Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Apache TomEE's OpenID Connect authentication has predictable state and nonce values due to a non-cryptographic random number generator. This may allow a remote attacker to forge an authentication callback. Affected versions are before 10.3.0 and 11.0.0-M2.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T15:36:13.641Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-111260"}]}}