CVE-2026-102460
Description
A flaw was found in Eclipse Vert.x Web. When chained authentication handlers are used to protect endpoints, the handler fails to validate required permission scopes if an incoming request was already authenticated by an earlier handler in the pipeline. An authenticated remote user with a valid token can exploit this vulnerability to bypass authorization controls and access restricted resources without holding the necessary permissions.
Statement
Red Hat rates this flaw as IMPORTANT. A flaw was found in Eclipse Vert.x Web's ChainAuthHandler when it is used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When an incoming request has already been authenticated by an earlier handler in the routing pipeline, ChainAuthHandler skips all scope validation configured via withScope() or withScopes(), in both any() and all() chain modes. An authenticated remote user with a valid token but insufficient scopes can exploit this flaw to bypass authorization controls and access restricted resources or perform actions without holding the necessary permissions. The most common trigger is overlapping authentication handlers on nested routes, where a parent route authenticates broadly and a child route uses a chain to enforce specific scopes. The Red Hat rating of IMPORTANT (CVSS 8.1) is consistent with the upstream assessment of High severity (CVSS 8.6). At the time of this assessment, no Red Hat products are listed as affected by this flaw; it concerns the upstream io.vertx:vertx-web Maven component, and no Red Hat shipping relationship has been established for it.
Mitigation
Avoid chaining authentication handlers on nested routes where parent routes pre-authenticate requests, or enforce scope validation explicitly within route handler logic rather than delegating to ChainAuthHandler.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | 5.9 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | High | N/A |
| Privileges Required | Low | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | None | N/A |
| Integrity Impact | High | None | N/A |
| Availability Impact | None | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
