CVE-2026-97880

Published 10 November 2026 · tracked since 11 November 2026

Description

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with Basi

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-125350 HIGH 8.8
• CVE-2026-125349 LOW 3.4
• CVE-2026-125348 HIGH 8.8
• CVE-2026-125347 CRITICAL 9.6
• CVE-2026-125346 HIGH 8.8
• CVE-2026-125345 MEDIUM 4.7
• CVE-2026-125344 HIGH 8.8
• CVE-2026-125343 HIGH 8.3
• CVE-2026-125342 MEDIUM 4.7
• CVE-2026-125326 MEDIUM 5.8

→ Open the live CVE board · all tools