CVE record · 1 source
CVE-2026-86532
The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner.
- Vendor
- Apache Software Foundation
- Product
- Apache TomEE
- Weakness
- CWE-203
- Exposure class
- Web platform
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner.
The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing…