{"id":"CVE-2026-86532","kind":"vulnerability","aliases":["CVE-2026-86532"],"related":[],"title":"JAAS login modules leak usernames and compare credentials non-constant-time","description":"The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"The bundled JAAS login modules reveal whether a username exists and compare credentials in a timing-dependent way. A remote attacker without an account can enumerate valid accounts and may infer credential material through timing analysis.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jaas","java","package"],"not_affected_if":["auth-not-exposed"],"how_to_check":null,"fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, which the description says fix the issue.","status":"open","published_at":"2026-11-10T15:17:30+00:00","first_seen_at":"2026-11-10T15:22:22+00:00","triaged_at":"2026-11-10T15:22:50+00:00","updated_at":"2026-11-10T15:22:50+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-10T15:22:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, which the description says fix the issue.","reach":"internet","title":"JAAS login modules leak usernames and compare credentials non-constant-time","impact":"low","summary":"The bundled JAAS login modules reveal whether a username exists and compare credentials in a timing-dependent way. A remote attacker without an account can enumerate valid accounts and may infer credential material through timing analysis.","audience":"businesses","category":"package","nicknames":[],"who_cares":["jaas","java"],"confidence":0.4,"fix_status":"available","needs_auth":"no","worst_case":"attacker enumerates accounts and may infer credential material","analyst_note":"Identify the affected product and its registry from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-86532 and confirm the fixed version line.","how_to_check":"- unknown","plain_action":"","product_name":"unknown","needs_analyst":true,"not_affected_if":["auth-not-exposed"],"who_is_affected":"The sources name no product, so the affected component is not confirmed. Teams running a JAAS login module from the affected line, where login is exposed to remote clients, should check their dependency versions. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000696,"input_tokens":4553,"output_tokens":482,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86532':15A,18A '10.3.0':102C '11.0.0':104C 'account':46B,50B,86C 'analysi':58B,94C 'attack':43B,82C 'bundl':23B,60C 'compar':7A,33B,70C 'constant':11A,76C 'credenti':8A,34B,54B,71C,90C 'cve':13A,16A 'depend':39B 'enumer':48B,84C 'exist':31B,68C 'fix':107C 'infer':53B,89C 'issu':109C 'jaa':1A,19B,24B,61C 'java':20B 'leak':4A,64C 'login':2A,25B,62C 'm2':105C 'manner':78C 'materi':55B,91C 'may':52B,88C 'modul':3A,26B,63C 'non':10A,75C 'non-constant-tim':9A,74C 'packag':21B 'recommend':97C 'remot':42B,80C 'reveal':27B 'time':12A,38B,57B,77C,93C 'timing-depend':37B 'unauthent':81C 'upgrad':99C 'user':95C 'usernam':5A,30B,67C 'valid':49B,85C 'version':101C 'way':40B 'whether':28B,65C 'without':44B","nicknames":[],"mitigations":[],"who_affected":"The sources name no product, so the affected component is not confirmed. Teams running a JAAS login module from the affected line, where login is exposed to remote clients, should check their dependency versions. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jaas","java","package","unknown"],"campaign_type":null,"search_a":"'-2026':14A,17A '-86532':15A,18A 'compar':7A 'constant':11A 'credenti':8A 'cve':13A,16A 'jaa':1A 'leak':4A 'login':2A 'modul':3A 'non':10A 'non-constant-tim':9A 'time':12A 'usernam':5A","search_b":"'account':46B,50B 'analysi':58B 'attack':43B 'bundl':23B 'compar':33B 'credenti':34B,54B 'depend':39B 'enumer':48B 'exist':31B 'infer':53B 'jaa':19B,24B 'java':20B 'login':25B 'materi':55B 'may':52B 'modul':26B 'packag':21B 'remot':42B 'reveal':27B 'time':38B,57B 'timing-depend':37B 'usernam':30B 'valid':49B 'way':40B 'whether':28B 'without':44B","search_c":"'10.3.0':102C '11.0.0':104C 'account':86C 'analysi':94C 'attack':82C 'bundl':60C 'compar':70C 'constant':76C 'credenti':71C,90C 'enumer':84C 'exist':68C 'fix':107C 'infer':89C 'issu':109C 'jaa':61C 'leak':64C 'login':62C 'm2':105C 'manner':78C 'materi':91C 'may':88C 'modul':63C 'non':75C 'non-constant-tim':74C 'recommend':97C 'remot':80C 'time':77C,93C 'unauthent':81C 'upgrad':99C 'user':95C 'usernam':67C 'valid':85C 'version':101C 'whether':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T15:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86532","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86532","severity":null,"published_at":"2026-11-10T15:17:30+00:00","modified_at":"2026-11-10T15:17:30+00:00","first_seen_at":"2026-11-10T15:22:22+00:00","fetched_at":"2026-11-10T15:22:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}