Unauthorized Access Vulnerability in Oracle Helidon Security Providers

CVE-2026-101580

What is CVE-2026-101580?

An unauthorized access vulnerability has been identified in Oracle's Helidon product, specifically within the helidon-security-providers-jwt component. This issue affects specific versions, allowing unauthenticated attackers with network access via HTTP to compromise Helidon environments. While the vulnerability is contained within Helidon, successful exploitation may lead to significant implications for other interconnected products by altering the expected data access scope. If exploited, attackers could gain unauthorized read access to a subset of data within Helidon, posing a serious risk to data confidentiality.

References