Parameter Substitution Vulnerability in EAP's Elytron Token-Realm
CVE-2026-85511

4.2MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Jboss Enterprise Application Platform 7
Red Hat Jboss Enterprise Application Platform 8
Red Hat Jboss Enterprise Application Platform Expansion Pack
Vendor
CVE Published:
18 September 2026

What is CVE-2026-85511?

A vulnerability exists in EAP's Elytron when using a security domain backed by an Elytron token-realm with OAuth2 introspection. This flaw arises from insufficient URL encoding, allowing for potential parameter substitution. Attackers could exploit this weakness to manipulate parameters in URL requests, potentially leading to unauthorized access or other security breaches. It is crucial for organizations utilizing EAP's Elytron to implement mitigations to protect against this vulnerability.

References

https://access.redhat.com/security/cve/CVE-2026-85511
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2483140
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.