{"id":"CVE-2026-111261","kind":"vulnerability","aliases":["CVE-2026-111261"],"related":[],"title":"Jakarta Security LDAP store accepts empty passwords, enabling login as any user","description":"The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can then authenticate as any existing user without knowing the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"The Jakarta Security LDAP identity store treats an empty password as valid when the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can log in as any existing user without knowing that user's password.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jakarta-security","java","ldap","package"],"not_affected_if":["directory-rejects-unauthenticated-binds","non-ldap-identity-store"],"how_to_check":"- Check whether your application uses the Jakarta Security LDAP identity store (`IdentityStore` backed by LDAP) and note the Jakarta Security version in use.\n- Check whether your directory server allows unauthenticated binds, for example by looking for anonymous bind settings in the LDAP server configuration.","fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, which the sources state fix the issue.","status":"open","published_at":"2026-11-10T16:17:16+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","triaged_at":"2026-11-10T16:24:02+00:00","updated_at":"2026-11-10T16:24:02+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T16:24:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, which the sources state fix the issue.","reach":"network","title":"Jakarta Security LDAP store accepts empty passwords, enabling login as any user","impact":"high","summary":"The Jakarta Security LDAP identity store treats an empty password as valid when the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can log in as any existing user without knowing that user's password.","audience":"developers","category":"package","nicknames":[],"who_cares":["jakarta-security","java","ldap"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker logs in as any existing user without the password.","analyst_note":"Confirm the affected version range and whether the advisory covers versions before 10.3.0 and 11.0.0-M2; the NVD text alone does not list ranges.","how_to_check":"- Check whether your application uses the Jakarta Security LDAP identity store (`IdentityStore` backed by LDAP) and note the Jakarta Security version in use.\n- Check whether your directory server allows unauthenticated binds, for example by looking for anonymous bind settings in the LDAP server configuration.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["non-ldap-identity-store","directory-rejects-unauthenticated-binds"],"who_is_affected":"Applications that authenticate users through the Jakarta Security LDAP identity store against a directory server that permits unauthenticated (anonymous) binds. Applications using other identity stores, or directory servers that reject empty-password binds, are not described as affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000758,"input_tokens":4554,"output_tokens":606,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111261':15A,18A '-2026':14A,17A '10.3.0':114C '11.0.0':116C 'accept':5A,73C 'allow':41B,83C 'attack':53B,95C 'authent':98C 'bind':43B,85C 'cve':13A,16A 'default':50B,92C 'directori':39B,46B,81C,88C 'empti':6A,33B,75C 'enabl':8A 'exist':59B,101C 'fix':119C 'ident':29B,71C 'issu':121C 'jakarta':1A,20B,26B,68C 'jakarta-secur':19B 'java':22B 'know':62B,104C 'ldap':3A,23B,28B,70C 'log':55B 'login':9A 'm2':117C 'packag':24B 'password':7A,34B,66B,76C,106C 'recommend':109C 'remot':52B,94C 'secur':2A,21B,27B,69C 'server':40B,47B,82C,89C 'store':4A,30B,72C 'treat':31B 'unauthent':42B,84C 'upgrad':111C 'user':12A,60B,64B,102C,107C 'valid':36B,78C 'version':113C 'without':61B,103C","nicknames":[],"mitigations":[],"who_affected":"Applications that authenticate users through the Jakarta Security LDAP identity store against a directory server that permits unauthenticated (anonymous) binds. Applications using other identity stores, or directory servers that reject empty-password binds, are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","jakartasecurity","java","ldap","package"],"campaign_type":null,"search_a":"'-111261':15A,18A '-2026':14A,17A 'accept':5A 'cve':13A,16A 'empti':6A 'enabl':8A 'jakarta':1A 'ldap':3A 'login':9A 'password':7A 'secur':2A 'store':4A 'user':12A","search_b":"'allow':41B 'attack':53B 'bind':43B 'default':50B 'directori':39B,46B 'empti':33B 'exist':59B 'ident':29B 'jakarta':20B,26B 'jakarta-secur':19B 'java':22B 'know':62B 'ldap':23B,28B 'log':55B 'packag':24B 'password':34B,66B 'remot':52B 'secur':21B,27B 'server':40B,47B 'store':30B 'treat':31B 'unauthent':42B 'user':60B,64B 'valid':36B 'without':61B","search_c":"'10.3.0':114C '11.0.0':116C 'accept':73C 'allow':83C 'attack':95C 'authent':98C 'bind':85C 'default':92C 'directori':81C,88C 'empti':75C 'exist':101C 'fix':119C 'ident':71C 'issu':121C 'jakarta':68C 'know':104C 'ldap':70C 'm2':117C 'password':76C,106C 'recommend':109C 'remot':94C 'secur':69C 'server':82C,89C 'store':72C 'unauthent':84C 'upgrad':111C 'user':102C,107C 'valid':78C 'version':113C 'without':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111261","severity":null,"published_at":"2026-11-10T16:17:16+00:00","modified_at":"2026-11-10T16:17:16+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","fetched_at":"2026-11-10T16:22:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}