CVE-2025-59390

Apache Druid’s Kerberos authenticator uses a weak fallback secret when the "druid.auth.authenticator.kerberos.cookieSignatureSecret" configuration is not explicitly set. In this case, the secret is generated using "ThreadLocalRandom", which is not a crypto-graphically secure random number...