Executive brief
Apache Kerby is a Java-based Kerberos implementation used for secure network authentication. A vulnerability has been identified where the system fails to properly validate certain authentication data, allowing an attacker to bypass the initial security checks required to verify a user's identity. This could potentially allow unauthorized access to services protected by the Kerberos protocol.
Technical details
A vulnerability in Apache Kerby (specifically the kerb-server component) allows for a Kerberos pre-authentication bypass. The issue stems from the server's failure to correctly validate or reject PA-DATA (Pre-Authentication Data) when it contains unrecognized or unsupported types, leading to a 'Missing Critical Step in Authentication' (CWE-304). An unauthenticated remote attacker can exploit this by sending a specially crafted Kerberos request to the KDC (Key Distribution Center) to bypass security checks. This issue is resolved in Apache Kerby version 2.1.2.
Affected products
- Apache Software Foundation Apache Kerby < 2.1.2
Timeline
- 2026-06-26: disclosed
- 2026-06-26: advisory