Executive brief
JBoss Enterprise Application Platform (EAP) uses the Elytron security framework to authenticate users via OAuth2 token introspection. A missing URL encoding vulnerability allows attackers to inject parameters into the introspection request, potentially bypassing authentication controls or accessing unauthorized resources without special privileges.
Technical details
The vulnerability exists in EAP's Elytron token-realm when configured with oauth2-introspection. Due to missing URL encoding in the introspection request construction, an attacker can inject arbitrary parameters into the URL, leading to parameter substitution attacks. The flaw affects applications that rely on Elytron's OAuth2 token introspection for security domain authentication. The attack is network-reachable and requires the application to be actively processing authentication requests, but does not require authentication or user interaction. An attacker can manipulate the token validation flow to potentially authenticate as an unintended user or escalate privileges. Patches are expected from Red Hat.
Affected products
- Red Hat JBoss Enterprise Application Platform <UNKNOWN>
Timeline
- 2026-09-18: disclosed