CVE-2026-91842
OpenBankProject OBP-API Kryo Redis.scala KryoInjection.invert deserialization
CVSS Score
4.1
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. This impacts the function KryoInjection.invert of the file obp-api/src/main/scala/code/api/cache/Redis.scala of the component Kryo Handler. Such manipulation leads to deserialization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-502 CWE-20 |
| Vendor | openbankproject |
| Product | obp-api |
| Published | Sep 15, 2026 |
| Last Updated | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for openbankproject obp-api
Be the first to know when new medium vulnerabilities affecting openbankproject obp-api are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
OpenBankProject / OBP-API
1.10.0 1.10.1
References
vuldb.com: https://vuldb.com/vuln/404073 vuldb.com: https://vuldb.com/vuln/404073/cti vuldb.com: https://vuldb.com/cve/CVE-2026-91842 vuldb.com: https://vuldb.com/submit/933652 github.com: https://github.com/OpenBankProject/OBP-API/issues/2888 github.com: https://github.com/OpenBankProject/OBP-API/security/advisories/GHSA-889g-wggr-jrrq github.com: https://github.com/OpenBankProject/OBP-API/
Credits
🔍 ZAST.AI (VulDB User) VulDB CNA Team