# CVE-2026-86532: JAAS login modules credential timing and username enumeration

Source: https://junglewise.ai/threats/cve-2026-86532-the-bundled-jaas-login-modules-leak-whether-a-username-exists-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-86532 · Severity: info · Published 2026-11-10

Bundled Java Authentication and Authorization Service (JAAS) login modules contain two security flaws: they reveal whether a username exists in the system, and they compare credentials in a way that is vulnerable to timing analysis. A remote attacker without credentials can enumerate valid usernames and potentially infer password information by measuring response times, but exploitation requires network access and careful timing measurements.

Technologies: [<UNKNOWN>](https://junglewise.ai/threats/technologies/x-unknown).

## Quick answers

**Is CVE-2026-86532 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86532 being exploited in the wild.

**How severe is CVE-2026-86532?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** <UNKNOWN>.

**Is there a fix for CVE-2026-86532?** Yes: fixed in 10.3.0, 11.0.0-M2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86532 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86532?** Check whether you run <UNKNOWN>. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.3.0, 11.0.0-M2

## Technical details

The vulnerability consists of two information disclosure issues in JAAS login modules: user enumeration through differential error messages or behavior, and non-constant-time password comparison enabling timing attacks to infer credential material. Both are remote unauthenticated attacks. A fix is available in version 10.3.0 and 11.0.0-M2.

## Affected products

- <UNKNOWN>

## Timeline

- 2026-11-10: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/oohwxbp6xx8dgl18xy1p1y6qjg59dgoh](https://lists.apache.org/thread.html/oohwxbp6xx8dgl18xy1p1y6qjg59dgoh)

## Related threats

- [System component denial of service vulnerability](https://junglewise.ai/threats/cve-2026-95784-a-vulnerability-exists-in-a-system-component-that-may-under)
- [Hessian remoting authentication bypass with non-root context path](https://junglewise.ai/threats/cve-2026-97874-when-hessian-remoting-is-configured-with-basic-authentication-the)
- [Embedded server weak session ID generation](https://junglewise.ai/threats/cve-2026-111259-the-embedded-server-generates-http-session-identifiers-with-a)
- [Web application request routing security constraint bypass](https://junglewise.ai/threats/cve-2026-111258-the-optional-request-routing-feature-forwards-requests-to-their)
- [SSH administration service authentication bypass](https://junglewise.ai/threats/cve-2026-111239-the-optional-ssh-administration-service-grants-full-access-to)