EUVD-2026-39650
GHSA-262p-fj3f-xh7v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Remote unauthenticated AS-REQ with a crafted PA-DATA type (AV:N/AC:L/PR:N/UI:N); a bypassed-but-not-forged auth control yields partial C/I/A, no scope change.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
6DescriptionCVE.org
It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.
Articles & Coverage 1
AnalysisAI
Authentication bypass in Apache Kerby before 2.1.2 lets remote attackers defeat Kerberos pre-authentication by submitting a PA-DATA element with an unrecognized or unsupported type, causing the KDC to skip the pre-auth check rather than reject the request. The flaw affects all Apache Kerby deployments below 2.1.2 acting as a Kerberos KDC/AS, and is fixed in version 2.1.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to an Apache Kerby instance (version < 2.1.2) operating as a Kerberos KDC/Authentication Service, and the ability to send an AS-REQ whose PA-DATA carries an unrecognized or unsupported type value - that crafted PA-DATA element is the specific trigger. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L = 7.3 High) indicates a network-reachable, low-complexity, unauthenticated attack with no user interaction, which is consistent with the description of sending a crafted PA-DATA to a KDC. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to a Kerby-backed KDC crafts an AS-REQ containing a PA-DATA element with an unrecognized or unsupported pre-auth type, causing the server to skip the pre-authentication check it should have enforced. Because the request is processed without proof of the client's long-term key, the attacker can interact with the authentication service in ways pre-auth is meant to prevent, all without credentials or user interaction (AV:N/AC:L/PR:N/UI:N). … |
| Remediation | Vendor-released patch: upgrade Apache Kerby to version 2.1.2, which the project states fixes this issue; this is the primary and recommended remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Apache Kerby below version 2.1.2 and document their criticality to your authentication infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Kerby
View allSame weakness CWE-304 – Missing Critical Step in Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today