CVE-2026-12605

The CVE-2026-12605 affects Eclipse GlassFish 8.0.x before 8.0.4. A CSRF + SSRF flaw in DownloadServlet ContentSources allows leakage of the admin gfresttoken to an attacker-controlled host when the victim is authenticated in the Admin Console, enabling full unauthenticated takeover of the GlassFi...