{"id":"CVE-2026-111240","kind":"vulnerability","aliases":["CVE-2026-111240"],"related":[],"title":"JDBC JAAS login module accepts blank password for NULL-password accounts","description":"The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"The JDBC-based JAAS login module accepts a login with no password for user accounts whose stored password is NULL. A remote attacker who knows such a user name can sign in as that user and obtain its roles.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jaas","jdbc","runtime","self-hosted"],"not_affected_if":["no-null-passwords","non-jdbc-login-module"],"how_to_check":"- Confirm whether the JDBC-based JAAS login module is in use in the server's login configuration.\n- Query the user table for rows where the stored password column is NULL.\n- Check the product version against the fixed versions below.","fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, which the description states fix the issue.","status":"open","published_at":"2026-11-10T16:17:14+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","triaged_at":"2026-11-10T16:25:20+00:00","updated_at":"2026-11-10T16:25:20+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T16:25:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, which the description states fix the issue.","reach":"network","title":"JDBC JAAS login module accepts blank password for NULL-password accounts","impact":"high","summary":"The JDBC-based JAAS login module accepts a login with no password for user accounts whose stored password is NULL. A remote attacker who knows such a user name can sign in as that user and obtain its roles.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["jaas","jdbc","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Remote attacker signs in as a user and gains its roles.","analyst_note":"Identify the affected product from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-111240) and confirm the vendor advisory for versions 10.3.0 and 11.0.0-M2.","how_to_check":"- Confirm whether the JDBC-based JAAS login module is in use in the server's login configuration.\n- Query the user table for rows where the stored password column is NULL.\n- Check the product version against the fixed versions below.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["non-jdbc-login-module","no-null-passwords"],"who_is_affected":"Only deployments that use the JDBC-based JAAS login module with NULL passwords stored in the user table are affected. Systems that use other login modules or have no NULL-password accounts are not affected. The sources do not name the product, so the exact server to check is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00075,"input_tokens":4569,"output_tokens":587,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111240':15A,18A '-2026':14A,17A '10.3.0':127C '11.0.0':129C 'accept':5A,32B,71C 'account':12A,40B,78C,95C 'affect':119C 'attack':48B,86C 'authent':97C 'base':28B,67C 'blank':6A 'cve':13A,16A 'deploy':106C 'fix':132C 'host':24B 'issu':134C 'jaa':2A,19B,29B,68C 'jdbc':1A,20B,27B,66C 'jdbc-base':26B 'know':50B,88C 'login':3A,30B,34B,69C,73C,109C 'm2':130C 'modul':4A,31B,70C,110C 'name':54B,91C 'null':10A,45B,83C,112C 'null-password':9A 'obtain':62B,102C 'password':7A,11A,37B,43B,76C,81C,113C 'recommend':122C 'remot':47B,85C 'role':64B,104C 'runtim':21B 'self':23B 'self-host':22B 'sign':56B 'store':42B,80C 'tabl':117C 'upgrad':124C 'use':107C 'user':39B,53B,60B,90C,100C,116C,120C 'version':126C 'whose':41B,79C 'without':74C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that use the JDBC-based JAAS login module with NULL passwords stored in the user table are affected. Systems that use other login modules or have no NULL-password accounts are not affected. The sources do not name the product, so the exact server to check is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","jaas","jdbc","runtime","selfhosted"],"campaign_type":null,"search_a":"'-111240':15A,18A '-2026':14A,17A 'accept':5A 'account':12A 'blank':6A 'cve':13A,16A 'jaa':2A 'jdbc':1A 'login':3A 'modul':4A 'null':10A 'null-password':9A 'password':7A,11A","search_b":"'accept':32B 'account':40B 'attack':48B 'base':28B 'host':24B 'jaa':19B,29B 'jdbc':20B,27B 'jdbc-base':26B 'know':50B 'login':30B,34B 'modul':31B 'name':54B 'null':45B 'obtain':62B 'password':37B,43B 'remot':47B 'role':64B 'runtim':21B 'self':23B 'self-host':22B 'sign':56B 'store':42B 'user':39B,53B,60B 'whose':41B","search_c":"'10.3.0':127C '11.0.0':129C 'accept':71C 'account':78C,95C 'affect':119C 'attack':86C 'authent':97C 'base':67C 'deploy':106C 'fix':132C 'issu':134C 'jaa':68C 'jdbc':66C 'know':88C 'login':69C,73C,109C 'm2':130C 'modul':70C,110C 'name':91C 'null':83C,112C 'obtain':102C 'password':76C,81C,113C 'recommend':122C 'remot':85C 'role':104C 'store':80C 'tabl':117C 'upgrad':124C 'use':107C 'user':90C,100C,116C,120C 'version':126C 'whose':79C 'without':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111240","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111240","severity":null,"published_at":"2026-11-10T16:17:14+00:00","modified_at":"2026-11-10T16:17:14+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","fetched_at":"2026-11-10T16:22:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}