Authentication Bypass Vulnerability in Azul Payara Administration Interface

CVE-2026-110003

What is CVE-2026-110003?

A vulnerability exists in the administration REST interface of Azul Payara, allowing remote attackers to bypass secure-access restrictions. By manipulating the 'X-GlassFish-authToken' HTTP header, an attacker can skip token validation checks, leading to potential unauthorized administrative access. In situations where domains are configured with an empty administrative password, this flaw enables attackers to authenticate without credentials, thus allowing the execution of arbitrary commands on the server and posing significant security risks.

References