CVE-2016-8741

The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for Java 6.0.x before 6.0.6 and 6.1.x before 6.1.1 prematurely terminate the SCRAM SASL negotiation if the provided user name does not exist thus allowing remote attacker to determine the existence of user accounts. The Vulnerability does not apply to AuthenticationProviders other than SCRAM-SHA-1 and SCRAM-SHA-256.

• CWE-200

• http://qpid.2158936.n2.nabble.com/CVE-2016-8741-Apache-Qpid-Broker-for-Java-Information-Leakage-td7657025.htmlVendor Advisory
• http://www.securityfocus.com/bid/95136Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037537Broken Link, Third Party Advisory, VDB Entry
• https://issues.apache.org/jira/browse/QPID-7599Issue Tracking
• http://qpid.2158936.n2.nabble.com/CVE-2016-8741-Apache-Qpid-Broker-for-Java-Information-Leakage-td7657025.htmlVendor Advisory
• http://www.securityfocus.com/bid/95136Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037537Broken Link, Third Party Advisory, VDB Entry
• https://issues.apache.org/jira/browse/QPID-7599Issue Tracking

Published

May 15, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-8735Remote code execution is possible with Apache Tomcat before …9.8
• CVE-2016-8736Apache OpenMeetings before 3.1.2 is vulnerable to Remote Cod…
• CVE-2016-8737In Apache Brooklyn before 0.10.0, the REST server is vulnera…
• CVE-2016-8738In Apache Struts 2.5 through 2.5.5, if an application allows…
• CVE-2016-8739The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x pr…
• CVE-2016-8740The mod_http2 module in the Apache HTTP Server 2.4.17 throug…
• CVE-2016-8742The Windows installer that the Apache CouchDB team provides …
• CVE-2016-8743Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.…7.5
• CVE-2016-8744Apache Brooklyn uses the SnakeYAML library for parsing YAML …
• CVE-2016-8745A bug in the error handling of the send file code for the NI…
• CVE-2016-8746Apache Ranger before 0.6.3 policy engine incorrectly matches…
• CVE-2016-8747An information disclosure issue was discovered in Apache Tom…7.5