CVE-2026-57915High· 7.3▾ TwilightApache Kerby has a bypass the Kerberos pre-authentication check
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.5%
It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.
org.apache.kerby:kerb-server < 2.1.2Upgrade to a patched release:
org.apache.kerby:kerb-server 2.1.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55957High· 7.3Apache Tomcat has a Missing Critical Step in Authentication vulnerability
CVE-2026-53404High· 7.3Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0…
CVE-2026-40542High· 7.3Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification
CVE-2026-50628Critical· 9.8A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address
CVE-2026-1486High· 8.8A flaw was found in Keycloak
CVE-2026-59898Medium· 5.3io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket) (CVE-2026-59898)