{"id":"CVE-2026-86532","aliases":[],"cve":{"records":[{"id":"CVE-2026-86532","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-07T19:42:26.633Z","published":"2026-11-10T14:53:27.146Z","modified":"2026-11-10T14:54:34.639Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-10T14:54:34.639Z"}],"references":[{"url":"https://lists.apache.org/thread.html/oohwxbp6xx8dgl18xy1p1y6qjg59dgoh","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-203","description":"CWE-203 Observable Discrepancy","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache TomEE: Username enumeration and timing side channel in JAAS login modules","titleSource":"apache","descriptionSource":"apache","description":"The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","score":null,"severity":"unknown","published":"2026-11-10T14:53:27.146Z","modified":"2026-11-10T14:54:34.639Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"4.0.0-beta-1","status":"affected","lessThanOrEqual":"4.7.5","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.openejb/openejb-core","packageIdentity":{"ecosystem":"Maven","name":"org.apache.openejb:openejb-core"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-86532"},{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"7.0.0-M1","status":"affected","lessThan":"10.0.0-M1","versionType":"semver"},{"version":"10.0.0-M1","status":"affected","lessThan":"10.3.0","versionType":"semver"},{"version":"11.0.0-M1","status":"affected","lessThan":"11.0.0-M2","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.tomee/openejb-core","packageIdentity":{"ecosystem":"Maven","name":"org.apache.tomee:openejb-core"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-86532"}],"remediation":[],"references":["https://lists.apache.org/thread.html/oohwxbp6xx8dgl18xy1p1y6qjg59dgoh"],"sources":[{"name":"CVE","id":"CVE-2026-86532","modified":"2026-11-10T14:54:34.639Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-86532"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-10T15:04:58.970Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:55:30.737Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-10T15:05:36.044Z","attemptedAt":"2026-11-10T15:05:36.044Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T15:05:36.203Z","attemptedAt":"2026-11-10T15:05:36.203Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T15:05:37.024Z","attemptedAt":"2026-11-10T15:05:37.024Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T15:05:36.241Z","attemptedAt":"2026-11-10T15:05:36.241Z"}],"evidence":[],"aiSummary":{"text":"Apache TomEE's JAAS login modules leak username existence and compare credentials in a non-constant-time manner, allowing a remote unauthenticated attacker to enumerate valid accounts. Affected versions include 4.0.0-beta-1 to 4.7.5, 7.0.0-M1 to less than 10.0.0-M1, 10.0.0-M1 to less than 10.3.0, and 11.0.0-M1 to less than 11.0.0-M2. This weakness may allow inference of credential material through timing analysis.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T15:06:12.295Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-86532"}]}}