---
id: "CVE-2026-57915"
kind: "vulnerability"
aliases: ["CVE-2026-57915", "GHSA-262p-fj3f-xh7v"]
title: "Apache Kerby has a bypass the Kerberos pre-authentication check"
severity: "high"
cvss: 7.3
epss: 0.00526
exploited: false
status: "open"
category: "package"
products: [{"name": "org.apache.kerby:kerb-server", "fixed": ["2.1.2"], "affected": "< 2.1.2", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["apache-kerby", "cwe-304", "cwe-358", "java", "kerberos", "maven", "package"]
not_affected_if: ["kerb-server-not-used", "version-2.1.2-or-later"]
published_at: "2026-06-26T13:16:35+00:00"
first_seen_at: "2026-11-03T22:02:22+00:00"
updated_at: "2026-11-03T22:07:19+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-262p-fj3f-xh7v", "first_seen_at": "2026-11-03T22:02:22+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57915", "first_seen_at": "2026-11-03T22:07:19+00:00"}]
---

# Apache Kerby has a bypass the Kerberos pre-authentication check

Apache Kerby, a Java Kerberos library, can be made to skip its Kerberos pre-authentication check by sending a PA-DATA element with an unrecognized or unsupported type. An attacker who can reach the Kerberos server built on kerb-server can get past pre-authentication without valid credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.kerby:kerb-server affected < 2.1.2 fixed 2.1.2

## How to check

- Run `mvn dependency:tree` and look for `org.apache.kerby:kerb-server`; a version below `2.1.2` is affected.
- Check the lockfile or build output for `kerb-server` pinned to an older version.

## Fix

- Apache Kerby (kerb-server): upgrade to `2.1.2`.

## Timeline

- 2026-11-03T22:02:22+00:00 ghsa https://github.com/advisories/GHSA-262p-fj3f-xh7v
- 2026-11-03T22:07:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57915

## Documents

- [fix] Patch: github.com https://github.com/apache/directory-kerby/commit/995fa59fac53f8e2e6fb987e0e29a5ae3a4bbf38
- [fix] Release: github.com https://github.com/apache/directory-kerby/releases/tag/kerby-all-2.1.2

## From the sources

It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_