An attacker can defeat the Kerberos pre‑authentication verification by sending a PA‑DATA message that contains an unrecognized or unsupported type. Because the check is bypassed, the server accepts the request and issues a ticket, effectively granting the attacker unauthorized Kerberos credentials. The weakness is a flaw in cryptographic input validation, categorized as CWE‑304 and CWE‑358, and can compromise both confidentiality and integrity of the authentication process.

The affected software is Apache Kerby, deployed by the Apache Software Foundation. Versions before 2.1.2 are vulnerable; users should upgrade to version 2.1.2 or later to obtain the fix.

No EPSS score is available, and the vulnerability is not listed in CISA KEV, indicating no known production exploitation yet. Nevertheless, the CVSS rating of 7.3, which is considered high, indicates that an attacker who can send arbitrary PA‑DATA can obtain Kerberos tickets without authenticating. The attack requires network access to the Kerberos service and sending a crafted PA‑DATA message; because unsupported types are ignored, the exploit is straightforward and does not rely on complex social engineering.