CVE-2026-85511

Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2

Published Sep 18, 2026 CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Description
A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Redhat jboss Fuse
Redhat red Hat Single Sign On
CPEs cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products Redhat jboss Fuse
Redhat red Hat Single Sign On
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
References
Type Values Removed Values Added
First Time appeared Redhat jboss Data Grid
CPEs cpe:/a:redhat:jboss_data_grid:8
Vendors & Products Redhat jboss Data Grid
Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Expansion Pack
Vendors & Products Redhat jboss Enterprise Application Platform Expansion Pack
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.
Title Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2
First Time appeared Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
Weaknesses CWE-290
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jbosseapxp
Vendors & Products Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Oct 20, 2026, 2:20 PM
Reserved
Sep 4, 2026, 4:45 AM
Status
Awaiting Analysis
Published
Sep 18, 2026, 3:17 PM
Modified
Oct 20, 2026, 3:17 PM
Severity
Low
Public date
Sep 18, 2026, 2:17 PM