CVE-2026-102460

A flaw was found in Eclipse Vert.x Web. When chained authentication handlers are used to protect endpoints, the handler fails to validate required permission scopes if an incoming request was already authenticated by an earlier handler in the pipeline. An authenticated remote user with a valid...

Incorrect Authorization

Overview io.vertx:vertx-web is a HTTP web applications for Vert.x. Affected versions of this package are vulnerable to Incorrect Authorization in the postAuthentication method of ChainAuthHandler, which depends on internal state set only during the authenticate phase, so when a preceding handler...

CVE-2026-102460

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already...

EUVD-2026-101605

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already...

CVE-2026-102460

Eclipse Vert.x Web (Maven coordinate io.vertx:vertx-web ) is vulnerable to a scope bypass in the ChainAuthHandler component. This affects versions [4.0.0, 4.5.34] , [5.0.0, 5.0.12] , [5.1.0, 5.1.9] , and [5.2.0, 5.2.0] . The root cause is that postAuthentication() relies on internal state establi...

CVE-2026-102460

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already...

CVE-2026-102460

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already...

CVE-2026-102460

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already...

CVE-2026-102460

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already...

CVE-2026-102460: Incorrect Authorization

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already...

PT-2026-113937

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 4.0.0 through 4.5.34 Eclipse Vert.x versions 5.0.0 through 5.0.12 Eclipse Vert.x versions 5.1.0 through 5.1.9 Eclipse Vert.x version 5.2.0 Description A scope bypass exists in the ChainAuthHandler of Eclipse Vert.x Web...