CVE-2026-57915

CVE-2026-57915: Apache Kerby: Kerberos Pre-Authentication Bypass

Vendor Apache Software Foundation

Product Apache Kerby

Weakness CWE-304

Published June 26, 2026

Last update June 30, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

Key dates

02Disclosure timeline

June 26, 2026 CVE published

June 30, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-57915 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/304.html

Related vulnerabilities

04Related CVE

CVE-2024-2172 Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege Escalation CVE-2022-1065 Multi Factor Authentication Bypass in various versions of Abacus ERP CVE-2022-2821 Missing Critical Step in Authentication in namelessmc/nameless CVE-2025-55138 CVE-2023-22833 Mandatory control bypass in Lime2