CVE-2026-102460

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 4.0.0 through 4.5.34 Eclipse Vert.x versions 5.0.0 through 5.0.12 Eclipse Vert.x versions 5.1.0 through 5.1.9 Eclipse Vert.x version 5.2.0

Description A scope bypass exists in the ChainAuthHandler of Eclipse Vert.x Web when utilized with authentication handlers that require scopes, such as JWTAuthHandler or OAuth2AuthHandler. If a user is already authenticated by a preceding handler in the request pipeline, the ChainAuthHandler skips all scope validation configured through withScope() or withScopes(), affecting both any() and all() chain modes. This occurs because the postAuthentication() function relies on internal state set during the authenticate() phase, which is bypassed for pre-authenticated users. Consequently, a user with a valid token but insufficient scopes can access protected resources, particularly in scenarios with overlapping authentication handlers on nested routes.

Recommendations Update Eclipse Vert.x versions 4.0.0 through 4.5.34 to a version newer than 4.5.34. Update Eclipse Vert.x versions 5.0.0 through 5.0.12 to a version newer than 5.0.12. Update Eclipse Vert.x versions 5.1.0 through 5.1.9 to a version newer than 5.1.9. Update Eclipse Vert.x version 5.2.0 to a version newer than 5.2.0.