From: Zdenek Dohnal <zdohnal@redhat.com>
Description: Fix for CVE-2025-58060

--- cups-2.4.1op1.orig/scheduler/auth.c
+++ cups-2.4.1op1/scheduler/auth.c
@@ -512,6 +512,15 @@ cupsdAuthorize(cupsd_client_t *con)	/* I
 
     int	userlen;			/* Username:password length */
 
+   /*
+    * Only allow Basic if enabled...
+    */
+
+    if (type != CUPSD_AUTH_BASIC)
+    {
+      cupsdLogClient(con, CUPSD_LOG_ERROR, "Basic authentication is not enabled.");
+      return;
+    }
 
     authorization += 5;
     while (isspace(*authorization & 255))
@@ -558,11 +567,7 @@ cupsdAuthorize(cupsd_client_t *con)	/* I
     * Validate the username and password...
     */
 
-    switch (type)
     {
-      default :
-      case CUPSD_AUTH_BASIC :
-          {
 #if HAVE_LIBPAM
 	   /*
 	    * Only use PAM to do authentication.  This supports MD5
@@ -712,10 +717,8 @@ cupsdAuthorize(cupsd_client_t *con)	/* I
               }
 	    }
 #endif /* HAVE_LIBPAM */
-          }
 
 	  cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Basic.", username);
-          break;
     }
 
     con->type = type;
@@ -733,6 +737,16 @@ cupsdAuthorize(cupsd_client_t *con)	/* I
 					/* Output token for username */
     gss_name_t		client_name;	/* Client name */
 
+   /*
+    * Only allow Kerberos if enabled...
+    */
+
+    if (type != CUPSD_AUTH_NEGOTIATE)
+    {
+      cupsdLogClient(con, CUPSD_LOG_ERROR, "Kerberos authentication is not enabled.");
+      return;
+    }
+
 #  ifdef __APPLE__
    /*
     * If the weak-linked GSSAPI/Kerberos library is not present, don't try
