CVE-2026-102460

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated on the routing context by a preceding handler in the request pipeline, ChainAuthHandler skips all scope validation configured via withScope() or withScopes(). This affects both any() and all() chain modes. The root cause is that postAuthentication() relies on internal state that is only set during the authenticate() phase, which is skipped entirely for pre-authenticated users. In any() mode, the absence of this state causes the method to fall through without delegating scope checks to any handler. In all() mode, scope checks are unconditionally skipped. This allows a user with a valid token but insufficient scopes to access resources protected by scope requirements, provided they were authenticated by an earlier handler in the pipeline. The most common trigger is overlapping authentication handlers on nested routes, where a parent route authenticates broadly and a child route uses a chain to enforce specific scopes. The impacted component Maven coordinate is io.vertx:vertx-web

• CWE-863

• https://github.com/vert-x3/vertx-web/security/advisories/GHSA-2p39-cr56-w58jVendor Advisory
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/339Issue Tracking, Third Party Advisory

Published

Oct 14, 2026

Last Modified

Oct 20, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102455EasyFlow .NET developed by Digiwin has a Insecure Deserializ…9.8
• CVE-2026-102456EasyFlow .NET developed by Digiwin has an SQL Injection vuln…6.5
• CVE-2026-102457EasyFlow .NET developed by Digiwin has an Arbitrary File Rea…6.5
• CVE-2026-102458EasyFlow .NET developed by Digiwin has a Missing Authenticat…9.8
• CVE-2026-102459EasyFlow .NET developed by Digiwin has a Reflected Cross-sit…6.1
• CVE-2026-10246A vulnerability has been found in SourceCodester Pharmacy Sa…3.5
• CVE-2026-102461In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]…5.9
• CVE-2026-102462In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]…5.9
• CVE-2026-102463In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]…5.9
• CVE-2026-102464In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]…5.9
• CVE-2026-102465In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]…5.9
• CVE-2026-102466In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]…5.9