CVE-2026-102460

waiting for further signals

GHSA-2p39-cr56-w58j ↗EUVD-2026-101605 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

maven:io.vertx:vertx-web 5.2.0; >=5.0.0, <=5.1.8; <=4.5.34

fixed in 5.2.1, 5.1.10, 4.5.35

ETK-2026-965, permanent identifier

pkg:maven/io.vertx/vertx-web

cvss8.1cna vendorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

6d 19h 45msince last run

11mAI analysis

timeline

0 = trigger signal

trigger signal +0dcve.org publication+6.9dwaiting for further signals+7.2d

+2d

+4d

+6d

description

Vert.x Web ChainAuthHandler can fail to enforce configured token scopes in affected releases. A user holding a valid token without the required permissions may reach scope-protected endpoints when an earlier handler has already authenticated the request, such as in overlapping parent and child routes.

mitigation

Upgrade io.vertx:vertx-web to 5.2.1; io.vertx:vertx-web to 5.1.10; io.vertx:vertx-web to 4.5.35 or later.

fixed in 5.2.1, 5.1.10, 4.5.35

check

exploit

automation

contextual

auth required

yes, low privileges

EPSS

0.27%18th percentile

agent run time

11m

cve.org record, t = 0

2026-10-14 18:36Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-07 21:53Z
ghsa: trigger signal, started the run
https://github.com/vert-x3/vertx-web/security/advisories/GHSA-2p39-cr56-w58j
2026-10-14 18:36Z
cve.org record for CVE-2026-102460
cve_org · https://www.cve.org/CVERecord?id=CVE-2026-102460

this entry in the feed

GET /api/v1/feed/CVE-2026-102460

{
  "etk_id": "ETK-2026-965",
  "cve_id": "CVE-2026-102460",
  "display_id": "CVE-2026-102460",
  "ghsa_id": "GHSA-2p39-cr56-w58j",
  "euvd_id": "EUVD-2026-101605",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Scope validation bypass in Vert.x Web ChainAuthHandler",
  "summary": "Vert.x Web ChainAuthHandler can fail to enforce configured token scopes in affected releases. A user holding a valid token without the required permissions may reach scope-protected endpoints when an earlier handler has already authenticated the request, such as in overlapping parent and child routes.",
  "mitigation": "Upgrade io.vertx:vertx-web to 5.2.1; io.vertx:vertx-web to 5.1.10; io.vertx:vertx-web to 4.5.35 or later.",
  "vendor": "maven",
  "product": "maven:io.vertx:vertx-web",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "5.2.0"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "5.2.1"
      ],
      "package_name": "io.vertx:vertx-web",
      "purl": "pkg:maven/io.vertx/vertx-web"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">=5.0.0, <=5.1.8"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "5.1.10"
      ],
      "package_name": "io.vertx:vertx-web",
      "purl": "pkg:maven/io.vertx/vertx-web"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "<=4.5.34"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "4.5.35"
      ],
      "package_name": "io.vertx:vertx-web",
      "purl": "pkg:maven/io.vertx/vertx-web"
    }
  ],
  "cwes": null,
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0027,
  "epss_percentile": 0.1854,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.810662433333333,
  "t0_at": "2026-10-14T18:36:41.358000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-07T21:53:27+00:00",
      "days": -6.863360625,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T18:36:41.358000+00:00",
      "url": "https://github.com/vert-x3/vertx-web/security/advisories/GHSA-2p39-cr56-w58j"
    }
  }
}

published 2026-10-08 10:59Z
last change 2026-10-21 21:36Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.