Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-91842

OpenBankProject OBP-API Kryo Redis.scala KryoInjection.invert deserialization

CVSS 4.0 2.1 LOWCVSS 3.1 4.1 MEDIUMCVSS 3.0 4.1 MEDIUMCVSS 2.0 4.3 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-91842

Published

A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. This impacts the function KryoInjection.invert of the file obp-api/src/main/scala/code/api/cache/Redis.scala of the component Kryo Handler. Such manipulation leads to deserialization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-91842

Published

OBP-API

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "OpenBankProject",
                    "product": "OBP-API",
                    "versions": [
                        {
                            "version": "1.10.0",
                            "status": "affected"
                        },
                        {
                            "version": "1.10.1",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:openbankproject:obp-api:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "Kryo Handler"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON