PT-2026-141739

CVE-2026-111261

·

Published

2026-11-10

·

Updated

2026-11-10

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can then authenticate as any existing user without knowing the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-287: Improper Authentication
Related identifiers
CVE-2026-111261
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com