{"id":"CVE-2026-57915","aliases":["GHSA-262p-fj3f-xh7v"],"title":"Apache Kerby has a bypass the Kerberos pre-authentication check","summary":"Apache Kerby has a bypass the Kerberos pre-authentication check","severity":"high","cvss":7.3,"cwe":["CWE-304","CWE-358"],"vendor":"apache","product":"org.apache.kerby:kerb-server","ecosystem":"maven","affected":["org.apache.kerby:kerb-server < 2.1.2"],"patched":["org.apache.kerby:kerb-server 2.1.2"],"published":"2026-06-26","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:01:13Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-262p-fj3f-xh7v","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57915"},{"url":"https://lists.apache.org/thread/1y3glgh3kzwoxo5m2lq504cjlh1dsrfh"},{"url":"http://www.openwall.com/lists/oss-security/2026/06/26/8"},{"url":"https://access.redhat.com/security/cve/CVE-2026-57915"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493407"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57915.json"},{"url":"https://github.com/apache/directory-kerby/commit/995fa59fac53f8e2e6fb987e0e29a5ae3a4bbf38"},{"url":"https://github.com/apache/directory-kerby/releases/tag/kerby-all-2.1.2"},{"url":"https://github.com/advisories/GHSA-262p-fj3f-xh7v"}],"tags":["ghsa","maven"],"epss":0.00526,"epssPercentile":0.44672,"ingestedAt":"2026-11-03T22:57:11.289Z","slug":"CVE-2026-57915","body":"## Overview\n\nIt is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.\n\n## Affected packages\n\n- `org.apache.kerby:kerb-server < 2.1.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.apache.kerby:kerb-server 2.1.2`","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}