https://bugzilla.redhat.com/show_bug.cgi?id=1390526
--- Doc Text *updated* by Timothy Walsh twalsh@redhat.com --- The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.
java-sig-commits@lists.fedoraproject.org