CVE-2026-91842: OpenBankProject OBP-API Kryo Redis.scala KryoInjection.invert deserialization
A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. This impacts the function KryoInjection.invert of the file obp-api/src/main/scala/code/api/cache/Redis.scala of the component Kryo Handler. Such manipulation leads to deserialization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation is remote, but the disclosed severity vector indicates that an attacker needs high privileges and that exploitation has high complexity. No user interaction is required.
Are deployments running the affected versions exposed by default?
The available information identifies OBP-API through version 1.10.1 and the Kryo Handler’s Redis.scala code path, but it does not state whether this functionality is enabled or reachable in a default deployment.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used, although the issue is described as difficult to exploit.
Is a fix available?
The provided information does not identify a fixed version or a vendor response. It states that the project was notified through an issue report but had not responded.