Cross-Site Scripting Vulnerability in Payara Server
CVE-2025-14340

7.3HIGH

Key Information:

Vendor

Payara Platform

Status
Payara Server
Vendor
CVE Published:
18 February 2026

What is CVE-2025-14340?

A cross-site scripting vulnerability exists in the REST Management Interface of Payara Server versions prior to 4.1.2.191.54, 5.83.0, 6.34.0, and 7.2026.1. This flaw can be exploited by an attacker to deceive the administrator into changing the admin password by leveraging malicious URL payloads. As a result, this vulnerability poses significant security risks that could lead to unauthorized access and potential data breaches.

Affected Version(s)

Payara Server 4.1.153.1 <= 4.1.2.191.53

Payara Server 5.20.0 <= 5.82.0

Payara Server 6.0.0 <= 6.33.0

References

https://docs.payara.fish/enterprise/docs/Security/Securit...

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Camilo Galdos <camilo.galdos@deepsecurity.pe>
.