CVE-2026-91842

Name of the Vulnerable Software and Affected Versions OpenBankProject OBP-API versions prior to 1.10.2

Description A remote deserialization issue exists within the Kryo Handler component. The flaw is located in the KryoInjection.invert() function within the obp-api/src/main/scala/code/api/cache/Redis.scala file. Deserialization occurs when untrusted data is processed, allowing for potential remote manipulation, although the attack complexity is high and exploitability is considered difficult.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the KryoInjection.invert() function to minimize the risk of exploitation.