CVE-2026-86532

Not scored yetLast modified Nov 12, 2026

Description

The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-203

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Apache Software FoundationApache TomEE>= 4.0.0-beta-1, <= 4.7.5
Apache Software FoundationApache TomEE>= 7.0.0-M1, < 10.0.0-M1; >= 10.0.0-M1, < 10.3.0; >= 11.0.0-M1, < 11.0.0-M2

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-865339.1Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to reCVE-2026-865358.7Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollutCVE-2026-865366.3Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. CVE-2026-865378.7Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache TCVE-2026-865387.5knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticatedCVE-2026-865397.2knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outboCVE-2026-86548.7Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands CVE-2026-865407.8knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers toCVE-2026-865418.3knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite CVE-2026-865429.1knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the impoCVE-2026-865439.8knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password requireCVE-2026-865448.1knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-o
CVE-2026-86532: Unscored | Vulnix