CVE-2026-102460

Undergoing Analysis Undergoing Analysis - In Progress

Vert.x Web ChainAuthHandler Scope Bypass Vulnerability

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: Eclipse Foundation

Description

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated on the routing context by a preceding handler in the request pipeline, ChainAuthHandler skips all scope validation configured via withScope() or withScopes(). This affects both any() and all() chain modes. The root cause is that postAuthentication() relies on internal state that is only set during the authenticate() phase, which is skipped entirely for pre-authenticated users. In any() mode, the absence of this state causes the method to fall through without delegating scope checks to any handler. In all() mode, scope checks are unconditionally skipped. This allows a user with a valid token but insufficient scopes to access resources protected by scope requirements, provided they were authenticated by an earlier handler in the pipeline. The most common trigger is overlapping authentication handlers on nested routes, where a parent route authenticates broadly and a child route uses a chain to enforce specific scopes. The impacted component Maven coordinate is io.vertx:vertx-web

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102460

EUVD

EUVD-2026-101605

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse	Foundation	Eclipse Vert.x 4.0.0
Eclipse	Foundation	Eclipse Vert.x 5.0.0
Eclipse	Foundation	Eclipse Vert.x 5.1.0
Eclipse	Foundation	Eclipse Vert.x 5.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a scope bypass in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers like JWTAuthHandler or OAuth2AuthHandler. It affects versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0. When a user is pre-authenticated by an earlier handler, ChainAuthHandler skips scope validation, allowing access to protected resources even if the user lacks required scopes.

Detection Guidance

To detect this vulnerability, check if your system uses Eclipse Vert.x Web versions within the affected ranges [4.0.0, 4.5.34], [5.0.0,5.0.12], [5.1.0,5.1.9], or [5.2.0, 5.2.0]. Inspect your application's dependency tree for io.vertx:vertx-web. Review authentication handler configurations, particularly ChainAuthHandler, JWTAuthHandler, or OAuth2AuthHandler, for scope validation bypasses in nested routes.

Impact Analysis

This vulnerability allows attackers with valid but insufficiently scoped tokens to bypass security controls and access protected resources. It is particularly dangerous in applications using nested routes with overlapping authentication handlers, where a parent route authenticates broadly and a child route enforces specific scopes.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data due to scope bypass in authentication. For GDPR, this may violate principles of data protection and user consent if unauthorized access occurs. For HIPAA, it could result in unauthorized disclosure of protected health information if scope checks are bypassed in healthcare applications.

Mitigation Strategies

Upgrade Eclipse Vert.x Web to patched versions: 4.5.35, 5.1.10, 5.2.1, or later. If upgrading is not immediately possible, review and modify authentication handler configurations to ensure scope validation occurs for all requests, regardless of pre-authentication. Remove overlapping authentication handlers on nested routes to prevent scope bypass scenarios.

Hi! I’m here to help you understand CVE-2026-102460. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70