{"id":"BIT-wildfly-2022-0866","details":"This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.","aliases":["CVE-2022-0866"],"modified":"2026-09-08T08:47:51.116513834Z","published":"2025-11-07T11:01:40.946Z","database_specific":{"severity":"Medium","cpes":["cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:*"]},"references":[{"type":"ADVISORY","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060929#c0"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0866"}],"affected":[{"package":{"name":"wildfly","ecosystem":"Bitnami","purl":"pkg:bitnami/wildfly"},"ranges":[{"type":"SEMVER","events":[{"introduced":"11.0.0"},{"fixed":"26.1.1"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/wildfly/BIT-wildfly-2022-0866.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}],"schema_version":"1.9.0"}