CVE-2026-86532 Apache TomEE: Username enumeration and timing side channel in JAAS login modules

The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or...

CVE-2026-86532

The Apache TomEE application server contains a vulnerability in its bundled JAAS login modules that leads to username enumeration and credential leakage. The root cause is that the modules leak whether a username exists and perform credential comparisons in a non-constant-time manner , allowing a...

CVE-2026-86532: Apache Software Foundation Apache TomEE: The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner

The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or...