AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Red HatCVE-2026-85511

Red Hat EAP: authentication bypass by spoofing

Red Hat

CVE-2026-85511 · Published Sep 18, 2026 · updated Sep 25, 2026

Medium4.2
No fix yet
Red Hat advisory

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-290

More Red Hat advisories

All Red Hat
Critical 9.3Sep 18Red Hat OpenShift console: server-side request forgeryCVE-2026-75885no fix yetMedium 6.5Sep 18Red Hat Netty: request smugglingCVE-2026-93574no fix yetMedium 6.5Sep 18Red Hat Netty: request smugglingCVE-2026-93562no fix yetMedium 6.1Sep 18A flaw was found in cockpit-filesCVE-2026-91202no fix yetMedium 6.0Sep 18Red Hat Enterprise Linux 9: race conditionCVE-2026-91203no fix yetMedium 6.0Sep 18Red Hat cockpit-files: race conditionCVE-2026-91205no fix yet