CVE-2026-85511 vulnerability in Red Hat Products
Published on September 18, 2026
Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2
A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.
Vulnerability Analysis
CVE-2026-85511 can be exploited with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public. 112 days later.
Weakness Type
Authentication Bypass by Spoofing
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.
Products Associated with CVE-2026-85511
stack.watch emails you whenever new vulnerabilities are published in Red Hat Jboss Enterprise Application Platform or Red Hat Jbosseapxp. Just hit a watch button to start following.