diff --git a/CVE-2025-58060.patch b/CVE-2025-58060.patch
new file mode 100644
index 0000000..5acbca4
--- /dev/null
+++ b/CVE-2025-58060.patch
@@ -0,0 +1,46 @@
+diff --git a/scheduler/auth.c b/scheduler/auth.c
+index 5fa53644d..3c9aa72aa 100644
+--- a/scheduler/auth.c
++++ b/scheduler/auth.c
+@@ -513,6 +513,16 @@ cupsdAuthorize(cupsd_client_t *con)	/* I - Client connection */
+     int	userlen;			/* Username:password length */
+ 
+ 
++   /*
++    * Only allow Basic if enabled...
++    */
++
++    if (type != CUPSD_AUTH_BASIC)
++    {
++      cupsdLogClient(con, CUPSD_LOG_ERROR, "Basic authentication is not enabled.");
++      return;
++    }
++
+     authorization += 5;
+     while (isspace(*authorization & 255))
+       authorization ++;
+@@ -558,7 +568,6 @@ cupsdAuthorize(cupsd_client_t *con)	/* I - Client connection */
+     * Validate the username and password...
+     */
+ 
+-    if (type == CUPSD_AUTH_BASIC)
+     {
+ #if HAVE_LIBPAM
+      /*
+@@ -727,6 +736,16 @@ cupsdAuthorize(cupsd_client_t *con)	/* I - Client connection */
+ 					/* Output token for username */
+     gss_name_t		client_name;	/* Client name */
+ 
++   /*
++    * Only allow Kerberos if enabled...
++    */
++
++    if (type != CUPSD_AUTH_NEGOTIATE)
++    {
++      cupsdLogClient(con, CUPSD_LOG_ERROR, "Kerberos authentication is not enabled.");
++      return;
++    }
++
+ #  ifdef __APPLE__
+    /*
+     * If the weak-linked GSSAPI/Kerberos library is not present, don't try
diff --git a/cups.spec b/cups.spec
index c60a493..e4b5838 100644
--- a/cups.spec
+++ b/cups.spec
@@ -22,7 +22,7 @@ Summary: CUPS printing system
 Name: cups
 Epoch: 1
 Version: 2.4.10
-Release: 11%{?dist}
+Release: 12%{?dist}
 # backend/failover.c - BSD-3-Clause
 # cups/md5* - Zlib
 # scheduler/colorman.c - Apache-2.0 WITH LLVM-exception AND BSD-2-Clause
@@ -105,6 +105,8 @@ Patch1011: 0001-scheduler-Clean-up-failed-IPP-Everywhere-permanent-q.patch
 # 0001-Add-NoSystem-SSLOptions-value.patch
 Patch1012: 0001-tls-gnutls.c-Use-system-crypto-policy-if-available.patch
 Patch1013: 0001-Add-NoSystem-SSLOptions-value.patch
+# RHEL-112419 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
+Patch1014: CVE-2025-58060.patch
 
 
 ##### Patches removed because IMHO they aren't no longer needed
@@ -362,6 +364,8 @@ to CUPS daemon. This solution will substitute printer drivers and raw queues in
 %patch -P 1012 -p1 -b .tls-system-policy
 # give a way how to opt-out from crypto policy
 %patch -P 1013 -p1 -b .nosystem-ssloption
+# RHEL-112419 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
+%patch -P 1014 -p1 -b .cve-2025-58060
 
 
 # Log to the system journal by default (bug #1078781, bug #1519331).
@@ -831,6 +835,9 @@ rm -f %{cups_serverbin}/backend/smb
 %{_mandir}/man7/ippeveps.7.gz
 
 %changelog
+* Thu Sep 11 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.10-12
+- RHEL-112419 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
+
 * Tue Jan 07 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.10-11
 - provide a way how to opt-out from system crypto policy if needed