CVE-2026-102460 Auth bypass in Eclipse Vert.x

High 8.6 Published 14 Oct 2026 Updated 19 Oct 2026

Attackers with valid tokens but insufficient scopes can bypass authorization checks in Eclipse Vert.x Web when using ChainAuthHandler with pre-authenticated contexts.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-102460?

CVE-2026-102460 is a high-severity authentication bypass vulnerability in Eclipse Vert.x, published on 14 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated on the routing context by a preceding handler in the request pipeline, ChainAuthHandler skips all scope validation configured via withScope() or withScopes(). This affects both any() and all() chain modes.

The root cause is that postAuthentication() relies on internal state that is only set during the authenticate() phase, which is skipped entirely for pre-authenticated users. In any() mode, the absence of this state causes the method to fall through without delegating scope checks to any handler. In all() mode, scope checks are unconditionally skipped.

This allows a user with a valid token but insufficient scopes to access resources protected by scope requirements, provided they were authenticated by an earlier handler in the pipeline. The most common trigger is overlapping authentication handlers on nested routes, where a parent route authenticates broadly and a child route uses a chain to enforce specific scopes.

The impacted component Maven coordinate is io.vertx:vertx-web

Weakness: CWE-863

Which versions are affected by CVE-2026-102460?

It affects 1 product.

Products include Eclipse Vert.x.

How do I fix CVE-2026-102460?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-102460 being exploited?

There is no known exploitation of CVE-2026-102460 in the wild and no public exploit code.

Sources

Also known as ECHO-7303-e7c2-a33c, GHSA-2p39-cr56-w58j, GHSA-wrr9-rmv8-g28m.