A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.
History

Fri, 25 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat jboss Fuse
Redhat red Hat Single Sign On
CPEs cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products Redhat jboss Fuse
Redhat red Hat Single Sign On

Tue, 22 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
References

Tue, 22 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat jboss Data Grid
CPEs cpe:/a:redhat:jboss_data_grid:8
Vendors & Products Redhat jboss Data Grid

Sat, 19 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Expansion Pack
Vendors & Products Redhat jboss Enterprise Application Platform Expansion Pack

Sat, 19 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

threat_severity

Low


Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 18 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.
Title Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2
First Time appeared Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
Weaknesses CWE-290
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jbosseapxp
Vendors & Products Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2026-09-18T14:29:01.894Z

Updated: 2026-10-20T14:20:59.343Z

Reserved: 2026-09-04T04:45:36.173Z

Link: CVE-2026-85511

cve-icon Vulnrichment

Updated: 2026-09-18T16:44:21.896Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-18T15:17:14.217

Modified: 2026-10-20T15:17:32.333

Link: CVE-2026-85511

cve-icon Redhat

Severity : Low

Publid Date: 2026-09-18T14:17:59Z

Links: CVE-2026-85511 - Bugzilla