CVE-2026-91462

A flaw was found in the Java Generic Security Services (JGSS) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted requests to exposed application programming interfaces (APIs), such as through a web service. A successful attack allows the unauthorized creation, deletion, or modification of critical data accessible to the application.

This vulnerability is rated with a Moderate severity rather than Important because exploitation involves high attack complexity and specifically depends on custom Java deployments exposing JGSS Kerberos token parsing to unauthenticated network input. In standard Red Hat Enterprise Linux environments, OpenJDK provides underlying cryptographic and authentication libraries, but exploitation cannot occur automatically without an application processing untrusted authentication tokens. Additionally, successful exploitation affects data integrity without directly threatening system availability or data confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.