---
id: "CVE-2026-111240"
page: "https://infrastack.ai/live/CVE-2026-111240"
kind: "vulnerability"
aliases: ["CVE-2026-111240"]
title: "JDBC JAAS login module accepts blank password for NULL-password accounts"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["jaas", "jdbc", "runtime", "self-hosted"]
not_affected_if: ["no-null-passwords", "non-jdbc-login-module"]
published_at: "2026-11-10T16:17:14+00:00"
first_seen_at: "2026-11-10T16:22:32+00:00"
updated_at: "2026-11-10T16:25:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111240", "first_seen_at": "2026-11-10T16:22:32+00:00"}]
exploit_sources: []
---

# JDBC JAAS login module accepts blank password for NULL-password accounts

Link for people: https://infrastack.ai/live/CVE-2026-111240 (this .md is for agents)

The JDBC-based JAAS login module accepts a login with no password for user accounts whose stored password is NULL. A remote attacker who knows such a user name can sign in as that user and obtain its roles.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the JDBC-based JAAS login module is in use in the server's login configuration.
- Query the user table for rows where the stored password column is NULL.
- Check the product version against the fixed versions below.

## Fix

- Upgrade to `10.3.0` or `11.0.0-M2`, which the description states fix the issue.

## Timeline

- 2026-11-10T16:22:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111240

## From the sources

The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_