CVE-2026-111261 · Package
NO FIX YET · SEE WHAT TO DO
The Jakarta Security LDAP identity store treats an empty password as valid when the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can log in as any existing user without knowing that user's password.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that authenticate users through the Jakarta Security LDAP identity store against a directory server that permits unauthenticated (anonymous) binds. Applications using other identity stores, or directory servers that reject empty-password binds, are not described as affected.
Not affected if directory-rejects-unauthenticated-binds, non-ldap-identity-store
Who cares jakarta-security, java, ldap
IdentityStore backed by LDAP) and note the Jakarta Security version in use.10.3.0 or 11.0.0-M2, which the sources state fix the issue.The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can then authenticate as any existing user without knowing the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.