CVE record · 1 source
CVE-2026-111261
The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some…
- Vendor
- Apache Software Foundation
- Product
- Apache TomEE
- Weakness
- CWE-287
- Exposure class
- Web platform
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some…
The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can then authenticate as any existing…