The bundled JAAS login modules have a vulnerability that leaks information about whether a username exists and perform credential comparisons in a non-constant-time manner. This allows a remote unauthenticated attacker to enumerate valid accounts and potentially infer credential material through timing analysis. The issue is fixed in versions 10.3.0 and 11.0.0-M2.