maven package report

Is org.expressme:JOpenId safe?

1 known vulnerability, worst severity HIGH.

cvss
7.5

how bad it is if exploited, out of 10

epss
0.90%

chance of exploitation in the next 30 days

xyz score
3.4

CyberXYZ composite, out of 10

fig. 01 — GHSA-m4f8-p58g-j8mj, the advisory selected below

// advisories

GHSA-m4f8-p58g-j8mj

HIGHCVE-2010-10006

A vulnerability, which was classified as problematic, was found in michaelliao jopenid. Affected is the function getAuthentication of the file JOpenId/src/org/expressme/openid/OpenIdManager.java. The manipulation leads to observable timing discrepancy. Upgrading to version 1.08 is able to address this issue. The name of the patch is c9baaa976b684637f0d5a50268e91846a7a719ab. It is recommended to up

Affected
< 1.08
Fixed in
1.08
Weakness
CWE-203
Published
2023-01-18
Source
github

GHSANVDMITREreferencereferencereferencereference

// dependencies

0 direct

Sign in for dependency paths and remediation

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.

Checked 2026-09-22 at 02:57 UTC. The most recent advisory here was published 2023-01-18. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.
Is org.expressme:JOpenId safe? maven package security report | CyberXYZ