CVE-2026-88819 Auth bypass in Eclipse Data Plane Core
Attackers can bypass authentication in Eclipse Data Plane Core because the refresh token handler fails to verify proof of possession of the issuer DID.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-88819?
CVE-2026-88819 is a medium-severity authentication bypass vulnerability in Eclipse Data Plane Core, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.
Which versions are affected by CVE-2026-88819?
How do I fix CVE-2026-88819?
No fix has been published for CVE-2026-88819 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-88819 being exploited?
There is no known exploitation of CVE-2026-88819 in the wild and no public exploit code.
Sources
Also known as GHSA-2f3m-r9cf-82r7.