Live › vulnerability › CVE-2026-101580
Go to dashboardOracle's Helidon JWT security provider module has a flaw that lets an unauthenticated remote attacker over HTTP read a subset of data Helidon can access. The advisory rates it CVSS 5.8 with confidentiality impact only.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use the Helidon JWT security provider to validate tokens on HTTP endpoints in the affected versions are exposed. Teams not running Helidon 4.0.0-4.5.5 or 27.0.0, or not using this module, can skip it.
No product ranges from the sources yet.
pom.xml or build.gradle) for helidon-security-providers-jwt at 4.0.0 through 4.5.5, or at 27.0.0.helidon-security-providers-jwt past the affected range (4.0.0-4.5.5 and 27.0.0) to the fixed release named in Oracle's advisory, which the sources do not state.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-jwt). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101580")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.