JDBC-Based JAAS Login Module Vulnerability in Apache Software

CVE-2026-111240

What is CVE-2026-111240?

The JDBC-based JAAS login module is susceptible to an authentication bypass flaw that permits remote attackers to gain unauthorized access to user accounts with NULL passwords. When deployed in systems where user accounts have NULL stored passwords, an attacker can exploit this vulnerability by using the corresponding username to authenticate and assume the roles associated with that account. It is crucial for users to upgrade to the latest versions (10.3.0 or 11.0.0-M2) to mitigate this risk.

References