Apache Kerby CVE-2026-57915

Exploitation requires network reachability to an Apache Kerby instance (version < 2.1.2) operating as a Kerberos KDC/Authentication Service, and the ability to send an AS-REQ whose PA-DATA carries an unrecognized or unsupported type value - that crafted PA-DATA element is the specific trigger. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no user interaction, and no special privileges are needed, and it works against the default request-handling path rather than an opt-in feature. The principal limiting factors are deployment scope (the target must actually be running Kerby pre-2.1.2 as its KDC, which is a relatively niche footprint) and network exposure of the Kerberos service; the assessed business impact is also bounded by NVD's Low/Low/Low impact rating rather than full ticket forgery.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L = 7.3 High) indicates a network-reachable, low-complexity, unauthenticated attack with no user interaction, which is consistent with the description of sending a crafted PA-DATA to a KDC. The Low/Low/Low impact triad, rather than High, suggests the bypass weakens an authentication control but does not by itself grant full ticket forgery or complete account takeover in NVD's scoring. No EPSS score was supplied, so exploitation probability cannot be quantified; the vulnerability is not in CISA KEV and no POC is referenced, so this is a real-but-not-yet-actively-exploited issue rather than an emergency. The most significant uncertainty is the precise post-bypass impact: 'bypassing pre-authentication' could range from enabling AS-REP-roasting-style offline attacks to broader unauthorized ticket issuance, and the exact downstream consequence is not detailed in the available data - verify scope against the Apache advisory before deprioritizing.

An attacker with network access to a Kerby-backed KDC crafts an AS-REQ containing a PA-DATA element with an unrecognized or unsupported pre-auth type, causing the server to skip the pre-authentication check it should have enforced. Because the request is processed without proof of the client's long-term key, the attacker can interact with the authentication service in ways pre-auth is meant to prevent, all without credentials or user interaction (AV:N/AC:L/PR:N/UI:N). No public proof-of-concept is referenced, so exploitation would currently require independent development against the AS-REQ/PA-DATA handling path.