---
id: "CVE-2026-111261"
page: "https://infrastack.ai/live/CVE-2026-111261"
kind: "vulnerability"
aliases: ["CVE-2026-111261"]
title: "Jakarta Security LDAP store accepts empty passwords, enabling login as any user"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["jakarta-security", "java", "ldap", "package"]
not_affected_if: ["directory-rejects-unauthenticated-binds", "non-ldap-identity-store"]
published_at: "2026-11-10T16:17:16+00:00"
first_seen_at: "2026-11-10T16:22:33+00:00"
updated_at: "2026-11-10T16:24:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111261", "first_seen_at": "2026-11-10T16:22:33+00:00"}]
exploit_sources: []
---

# Jakarta Security LDAP store accepts empty passwords, enabling login as any user

Link for people: https://infrastack.ai/live/CVE-2026-111261 (this .md is for agents)

The Jakarta Security LDAP identity store treats an empty password as valid when the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can log in as any existing user without knowing that user's password.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether your application uses the Jakarta Security LDAP identity store (`IdentityStore` backed by LDAP) and note the Jakarta Security version in use.
- Check whether your directory server allows unauthenticated binds, for example by looking for anonymous bind settings in the LDAP server configuration.

## Fix

- Upgrade to `10.3.0` or `11.0.0-M2`, which the sources state fix the issue.

## Timeline

- 2026-11-10T16:22:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111261

## From the sources

The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can then authenticate as any existing user without knowing the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_