CVE-2026-86532 - Vulnerability Details - OpenCVE

The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache TomEE

unaffected

Version	Status	Constraints
`4.0.0-beta-1`	affected	≤ 4.7.5

Apache Software Foundation

Apache TomEE

unaffected

Version	Status	Constraints
`7.0.0-M1`	affected	< 10.0.0-M1
`10.0.0-M1`	affected	< 10.3.0
`11.0.0-M1`	affected	< 11.0.0-M2

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://lists.apache.org/thread.html/oohwxbp6xx8dgl18xy1p1y6qjg59dgoh

History

Tue, 10 Nov 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Title		Apache TomEE: Username enumeration and timing side channel in JAAS login modules
Weaknesses		CWE-203
References		https://lists.apache.org/thread.html/oohwxbp6xx8dgl18xy1p1y6qjg59dgoh

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2026-11-10T14:53:27.146Z

Updated: 2026-11-10T14:54:34.639Z

Reserved: 2026-09-07T19:42:26.633Z

Link: CVE-2026-86532

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-10T15:17:30.073

Modified: 2026-11-10T15:17:30.073

Link: CVE-2026-86532

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-203

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86532", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-07T19:42:26.633Z", "datePublished": "2026-11-10T14:53:27.146Z", "dateUpdated": "2026-11-10T14:54:34.639Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-10T14:54:34.639Z"}, "title": "Apache TomEE: Username enumeration and timing side channel in JAAS login modules", "problemTypes": [{"descriptions": [{"description": "CWE-203 Observable Discrepancy", "lang": "en", "cweId": "CWE-203", "type": "CWE"}]}], "source": {"discovery": "INTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache TomEE", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.openejb:openejb-core", "packageURL": "pkg:maven/org.apache.openejb/openejb-core", "versions": [{"status": "affected", "version": "4.0.0-beta-1", "lessThanOrEqual": "4.7.5", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache TomEE", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.tomee:openejb-core", "packageURL": "pkg:maven/org.apache.tomee/openejb-core", "versions": [{"status": "affected", "version": "7.0.0-M1", "lessThan": "10.0.0-M1", "versionType": "semver"}, {"status": "affected", "version": "10.0.0-M1", "lessThan": "10.3.0", "versionType": "semver"}, {"status": "affected", "version": "11.0.0-M1", "lessThan": "11.0.0-M2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}]}], "references": [{"url": "https://lists.apache.org/thread.html/oohwxbp6xx8dgl18xy1p1y6qjg59dgoh", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "The Apache Software Foundation", "type": "finder"}, {"lang": "en", "value": "Claude Security", "type": "tool"}, {"lang": "en", "value": "Markus Jung", "type": "remediation developer"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}}}