PT-2026-141723

CVE-2026-86532

·

Published

2026-11-10

·

Updated

2026-11-10

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-203: Observable Discrepancy
Related identifiers
CVE-2026-86532
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com