CVE record · 1 source
CVE-2026-111240
The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL.
- Vendor
- Apache Software Foundation
- Product
- Apache TomEE
- Weakness
- CWE-287
- Exposure class
- Web platform
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL.
The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only…