Scope Bypass Vulnerability in Eclipse Vert.x Web - Eclipse Foundation

CVE-2026-102460

What is CVE-2026-102460?

A scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with authentication handlers requiring scopes, like JWTAuthHandler and OAuth2AuthHandler. This issue arises when a user already authenticated by a prior handler in the request flow circumvents scope validation set via withScope() or withScopes(). The vulnerability is exploited in both any() and all() chain modes due to the reliance on internal state set exclusively during the authenticate() process, which is bypassed for pre-authenticated users. As a result, users with valid tokens but lacking adequate scopes can gain access to resources protected by scope requirements. This is particularly concerning for configurations where parent routes authenticate broadly while child routes enforce specific scope checks, potentially leading to unauthorized access.

References