Authentication Vulnerability in JAAS Login Modules by Apache
CVE-2026-86532

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Tomee
Vendor
CVE Published:
10 November 2026

What is CVE-2026-86532?

The JAAS login modules from Apache have a vulnerability that allows unprivileged remote attackers to determine the existence of usernames and compare credentials in a non-constant-time manner. This flaw can lead to possible account enumeration and can compromise user credentials through timing analysis. Users are advised to upgrade to the latest versions, 10.3.0 or 11.0.0-M2, to mitigate these security risks.

Affected Version(s)

Apache TomEE 4.0.0-beta-1 <= 4.7.5

Apache TomEE 7.0.0-M1 < 10.0.0-M1

Apache TomEE 10.0.0-M1 < 10.3.0

References

https://lists.apache.org/thread.html/oohwxbp6xx8dgl18xy1p...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The Apache Software Foundation
Claude Security
Markus Jung
.