CVE-2026-111240 · Runtime
NO FIX YET · SEE WHAT TO DO
The JDBC-based JAAS login module accepts a login with no password for user accounts whose stored password is NULL. A remote attacker who knows such a user name can sign in as that user and obtain its roles.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only deployments that use the JDBC-based JAAS login module with NULL passwords stored in the user table are affected. Systems that use other login modules or have no NULL-password accounts are not affected. The sources do not name the product, so the exact server to check is unknown.
Not affected if no-null-passwords, non-jdbc-login-module
Who cares jaas, jdbc, self-hosted
10.3.0 or 11.0.0-M2, which the description states fix the issue.The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.