CVE-2026-91842
mediumA vulnerability has been found in OpenBankProject OBP-API up to 1.10.1.
A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. This impacts the function KryoInjection.invert of the file obp-api/src/main/scala/code/api/cache/Redis.scala of the component Kryo Handler. Such manipulation leads to deserialization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/OpenBankProject/OBP-API/ cna@vuldb.com
- https://github.com/OpenBankProject/OBP-API/issues/2888 cna@vuldb.com
- https://github.com/OpenBankProject/OBP-API/security/advisories/GHSA-889g-wggr-jrrq cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-91842 cna@vuldb.com
- https://vuldb.com/submit/933652 cna@vuldb.com
- https://vuldb.com/vuln/404073 cna@vuldb.com
- https://vuldb.com/vuln/404073/cti cna@vuldb.com