oss-sec mailing list archives

CVE-2026-57915: Apache Kerby: Kerberos Pre-Authentication Bypass

From: Colm O hEigeartaigh <coheigea () apache org>
Date: Fri, 26 Jun 2026 10:46:49 +0000

Severity: important 

Affected versions:

- Apache Kerby (org.apache.kerby:kerb-server) before 2.1.2

Description:

It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an 
unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

References:

https://directory.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-57915

Current thread:

CVE-2026-57915: Apache Kerby: Kerberos Pre-Authentication Bypass Colm O hEigeartaigh (Jun 26)