CVE-2026-86532
2026-11-10
15h17 +00:00
15h17 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Observable Discrepancy The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor. |
