CVE-2026-102705

XAPI xapi-project/xen-api compares the Pool Secret, the bearer token that authenticates requests between hosts in a pool, with a data-dependent comparison String.equal, and polymorphic = in older releases. An attacker may use the timing as an oracle to infer the Pool Secret and gain full access t...