Apache Jakarta Security up to 10.0.0-M0/10.2.x/11.0.0-M1 Identity Store improper authentication

Summaryinfo

A vulnerability identified as critical has been detected in Apache Jakarta Security up to 10.0.0-M0/10.2.x/11.0.0-M1. Affected by this vulnerability is an unknown functionality of the component Identity Store. Performing a manipulation results in improper authentication. This vulnerability is known as CVE-2026-111248. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Apache Jakarta Security up to 10.0.0-M0/10.2.x/11.0.0-M1. This affects some unknown functionality of the component Identity Store. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users file or backup, can authenticate with the digest instead of the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

The advisory is shared at lists.apache.org. This vulnerability is uniquely identified as CVE-2026-111248 since 10/15/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/10/2026).

Upgrading to version 10.3.0 or 11.0.0-M2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Apache

Name

• Jakarta Security

Version

• 10.0
• 10.0.0-M0
• 10.1
• 10.2
• 11.0.0-M1

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion