Incorrect authorization in Vert.x-Web - CVE-2026-102460
Published: November 9, 2026
Vulnerability identifier: #VU162826
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102460
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged remote attacker to access resources without possessing the required authorization scopes.
The vulnerability exists due to skipped scope validation in Eclipse Vert.x Web's ChainAuthHandler when an earlier request handler has already authenticated the user and the chain contains scope-requiring authentication handlers. A low-privileged remote attacker can submit a valid token with insufficient scopes to routes using this configuration and bypass the chain's scope requirements.
Affected software
Vert.x-Web
How to mitigate CVE-2026-102460
Install security update from vendor's website.
Vert.x-Web - addressed in versions 4.5.35, 5.1.10, 5.2.1