Bug 2552802 (CVE-2026-102460)

Summary: CVE-2026-102460 io.vertx/vertx-web: vertx-web: Authorization bypass via ChainAuthHandler scope validation failure
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: ant, aschwart, asyoung, aszczucz, boliveir, cescoffi, cmah, dhanak, drichtar, drosa, dsimansk, ewittman, fmariani, fmongiar, gmalinko, gsmet, gtanzill, janstey, jbuscemi, jhollowa, jmartisk, jnethert, jwon, kaycoth, kingland, manderse, mcarlett, mnovotny, mposolda, nipatil, olubyans, ozzy, pantinor, pdelbell, pjindal, prichard, rguimara, rhel-process-autobot, rkubis, rmartinc, rstepani, sausingh, sbiarozk, sdawley, ssilvert, sthirugn, sthorger, tcunning, varjain, vmuzikar, watson-tool-maintainers, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Eclipse Vert.x Web. When chained authentication handlers are used to protect endpoints, the handler fails to validate required permission scopes if an incoming request was already authenticated by an earlier handler in the pipeline. An authenticated remote user with a valid token can exploit this vulnerability to bypass authorization controls and access restricted resources without holding the necessary permissions.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-14 19:03:43 UTC 
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated on the routing context by a preceding handler in the request pipeline, ChainAuthHandler skips all scope validation configured via withScope() or withScopes(). This affects both any() and all() chain modes.



The root cause is that postAuthentication() relies on internal state that is only set during the authenticate() phase, which is skipped entirely for pre-authenticated users. In any() mode, the absence of this state causes the method to fall through without delegating scope checks to any handler. In all() mode, scope checks are unconditionally skipped.



This allows a user with a valid token but insufficient scopes to access resources protected by scope requirements, provided they were authenticated by an earlier handler in the pipeline. The most common trigger is overlapping authentication handlers on nested routes, where a parent route authenticates broadly and a child route uses a chain to enforce specific scopes.



The impacted component Maven coordinate is io.vertx:vertx-web