A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.
Metrics
Affected Vendors & Products
References
History
Fri, 25 Sep 2026 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat jboss Fuse
Redhat red Hat Single Sign On |
|
| CPEs | cpe:/a:redhat:jboss_fuse:7 cpe:/a:redhat:red_hat_single_sign_on:7 |
|
| Vendors & Products |
Redhat jboss Fuse
Redhat red Hat Single Sign On |
Tue, 22 Sep 2026 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 |
|
| References |
|
Tue, 22 Sep 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat jboss Data Grid
|
|
| CPEs | cpe:/a:redhat:jboss_data_grid:8 | |
| Vendors & Products |
Redhat jboss Data Grid
|
Sat, 19 Sep 2026 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat jboss Enterprise Application Platform Expansion Pack
|
|
| Vendors & Products |
Redhat jboss Enterprise Application Platform Expansion Pack
|
Sat, 19 Sep 2026 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Fri, 18 Sep 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Fri, 18 Sep 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding. | |
| Title | Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2 | |
| First Time appeared |
Redhat
Redhat jboss Enterprise Application Platform Redhat jbosseapxp |
|
| Weaknesses | CWE-290 | |
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jbosseapxp |
|
| Vendors & Products |
Redhat
Redhat jboss Enterprise Application Platform Redhat jbosseapxp |
|
| References |
| |
| Metrics |
cvssV3_1
|
Status: PUBLISHED
Assigner: redhat
Published: 2026-09-18T14:29:01.894Z
Updated: 2026-10-20T14:20:59.343Z
Reserved: 2026-09-04T04:45:36.173Z
Link: CVE-2026-85511
Updated: 2026-09-18T16:44:21.896Z
Status : Awaiting Analysis
Published: 2026-09-18T15:17:14.217
Modified: 2026-10-20T15:17:32.333
Link: CVE-2026-85511