CVE-2025-59390

Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`, which is not a crypto-graphically secure random number generator. This may allow an attacker to predict or brute force the secret used to sign authentication cookies, potentially enabling token forgery or authentication bypass. Additionally, each process generates its own fallback secret, resulting in inconsistent secrets across nodes. This causes authentication failures in distributed or multi-broker deployments, effectively leading to a incorrectly configured clusters. Users are advised to configure a strong `druid.auth.authenticator.kerberos.cookieSignatureSecret` This issue affects Apache Druid: through 34.0.0. Users are recommended to upgrade to version 35.0.0, which fixes the issue making it mandatory to set `druid.auth.authenticator.kerberos.cookieSignatureSecret` when using the Kerberos authenticator. Services will fail to come up if the secret is not set.

• CWE-338

• https://lists.apache.org/thread/jwjltllnntgj1sb9wzsjmvwm9f8rlhg8Vendor Advisory
• http://www.openwall.com/lists/oss-security/2025/11/26/1Mailing List, Third Party Advisory

Published

Nov 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59385An authentication bypass by spoofing vulnerability has been …9.8
• CVE-2025-59386A NULL pointer dereference vulnerability has been reported t…4.9
• CVE-2025-59387An SQL injection vulnerability has been reported to affect M…8.1
• CVE-2025-59388A use of hard-coded password vulnerability has been reported…9.8
• CVE-2025-59389An SQL injection vulnerability has been reported to affect H…9.8
• CVE-2025-5939The Telegram for WP plugin for WordPress is vulnerable to St…4.4
• CVE-2025-59391A memory disclosure vulnerability exists in libcoap's OSCORE…6.5
• CVE-2025-59392On Elspec G5 devices through 1.2.2.19, a person with physica…6.8
• CVE-2025-59396Rejected reason: Not a security vulnerability
• CVE-2025-59397Open Web Analytics (OWA) before 1.8.1 allows owa_db.php v[va…5
• CVE-2025-59398The OCPP implementation in libocpp before 0.26.2 allows a de…3.1
• CVE-2025-59399libocpp before 0.28.0 allows a denial of service (EVerest cr…3.1