CVE-2026-111261
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 10, 2026
Vendor
unknown
Description
The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can then authenticate as any existing user without knowing the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.