CVE-2026-86532: Apache TomEE: Username enumeration and timing side channel in JAAS login modules

Q: Who can exploit this issue?

A remote attacker does not need to authenticate. The affected JAAS login modules expose account-existence information and timing differences during login attempts.

Q: What information could an attacker obtain?

An attacker can enumerate valid usernames and may be able to infer credential material by analyzing credential-comparison timing.

Q: Which versions address the issue?

Apache recommends upgrading to TomEE 10.3.0 or 11.0.0-M2, which fix the issue.

Published Nov 10, 2026

Updated

The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Affected Software

1 affected component

Apache TomEE<10.3.0, <11.0.0-M2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 10.3.0
Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 11.0.0-M2

Event History

Nov 10, 2026

CVE Published

via MITRE·02:53 PM

Data Sourced

via MITRE·02:53 PM

DescriptionWeakness

Data Sourced

via NVD·03:17 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A remote attacker does not need to authenticate. The affected JAAS login modules expose account-existence information and timing differences during login attempts.

What information could an attacker obtain?

An attacker can enumerate valid usernames and may be able to infer credential material by analyzing credential-comparison timing.

Which versions address the issue?

Apache recommends upgrading to TomEE 10.3.0 or 11.0.0-M2, which fix the issue.

CVE-2026-86532: Apache TomEE: Username enumeration and timing side channel in JAAS login modules

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could an attacker obtain?

Which versions address the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could an attacker obtain?

Which versions address the issue?