# CVE-2026-101580: Oracle Helidon JWT authentication bypass

Source: https://junglewise.ai/threats/cve-2026-101580-vulnerability-in-the-helidon-product-of-oracle-fusion-middleware  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-101580 · Severity: medium · CVSS 5.8 · Published 2026-10-20

Oracle Helidon is a Java-based microservices framework that includes JWT authentication through its security providers. An unauthenticated attacker on the network can bypass authentication and gain unauthorized read access to sensitive data protected by the JWT security component, potentially affecting dependent applications that use Helidon for authentication.

Technologies: [Oracle Helidon](https://junglewise.ai/threats/technologies/helidon). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-101580 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101580 being exploited in the wild.

**How severe is CVE-2026-101580?** Medium severity, with a CVSS score of 5.8, published 20 October 2026.

**Which products and versions are affected?** Oracle Helidon 4.0.0-4.5.5, 27.0.0.

**Is there a fix for CVE-2026-101580?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-101580 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-101580?** Check whether you run Oracle Helidon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the helidon-security-providers-jwt component and allows unauthenticated attackers to compromise the JWT authentication mechanism via network-accessible HTTP endpoints. An attacker with no prior authentication can exploit this easily to gain unauthorized read access to a subset of Helidon's data, with potential scope impact on systems that depend on Helidon for authentication.

## Affected products

- Oracle Helidon 4.0.0-4.5.5, 27.0.0

## Timeline

- 2026-10-20: disclosed

## References

- [https://www.oracle.com/security-alerts/cpuoct2026.html](https://www.oracle.com/security-alerts/cpuoct2026.html)

## Related threats

- [Oracle Helidon microprofile-security authentication bypass](https://junglewise.ai/threats/cve-2026-101590-vulnerability-in-the-helidon-product-of-oracle-fusion-middleware)
- [Oracle Helidon WebSocket unauthenticated information disclosure](https://junglewise.ai/threats/cve-2026-101588-vulnerability-in-the-helidon-product-of-oracle-fusion-middleware)
- [Oracle Helidon denial of service in webclient HTTP/1](https://junglewise.ai/threats/cve-2026-101587-vulnerability-in-the-helidon-product-of-oracle-fusion-middleware)
- [Oracle Helidon information disclosure in helidon-webclient](https://junglewise.ai/threats/cve-2026-101586-vulnerability-in-the-helidon-product-of-oracle-fusion-middleware)
- [Oracle Helidon CORS authorization bypass in helidon-cors](https://junglewise.ai/threats/cve-2026-101585-vulnerability-in-the-helidon-product-of-oracle-fusion-middleware)