Eclipse Vert.x Web EUVD-2026-101605

Exploitation requires an application built on vertx-web that uses ChainAuthHandler together with scope-requiring authentication handlers (JWTAuthHandler or OAuth2AuthHandler) configured via withScope() or withScopes(), in either any() or all() chain mode. Critically, the victim request pipeline must authenticate the user via a preceding handler before the chain runs - the most common trigger being overlapping authentication handlers on nested routes where a parent route authenticates broadly and a child route's chain enforces specific scopes. The attacker must possess a valid token (PR:L / authenticated) but one lacking the required scopes. Limiting factors: this is NOT a default configuration - it depends on the specific nested/overlapping route-plus-chain setup described, and it requires valid prior authentication, so unauthenticated attackers cannot trigger it. Affected only in vertx-web 4.0.0-4.5.34, 5.0.0-5.0.12, 5.1.0-5.1.9, and 5.2.0.

This is a genuine authorization-control weakness rather than a hype-driven high score. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and base score of 8.6 indicate a network-reachable flaw with low attack complexity, but PR:L confirms the attacker must already hold a valid authentication token - so this is an authenticated privilege/scope escalation, not an unauthenticated breach. No EPSS score, CISA KEV listing, or POC indicator was provided in the input, so there is no evidence of active exploitation or public exploit code; exploitation status is therefore 'no public exploit identified at time of analysis.' The real limiting factor is configuration-dependence: the bypass only manifests when ChainAuthHandler is combined with scope-requiring handlers AND the user is pre-authenticated by an earlier pipeline handler (the classic nested parent/child route pattern). This narrows real-world exposure well below what the 8.6 implies for any single deployment. Net: a real priority for teams that use vertx-web scope enforcement on nested routes, but not a mass-exploitation 'patch-tonight' event absent KEV/EPSS signals. Note the discrepancy worth flagging to defenders - the CVSS impact is marked VC:H/VI:H (high confidentiality and integrity), yet the described impact is scope/authorization bypass granting access beyond granted permissions, which is plausible but should be validated against the specific resources each application protects.

An application authenticates users broadly on a parent route, then relies on a child route's ChainAuthHandler with JWTAuthHandler/OAuth2AuthHandler and withScope() to restrict a sensitive endpoint. An attacker holding a valid token with insufficient scopes requests the child endpoint; because they were already authenticated upstream, postAuthentication() skips scope validation and grants access to the scope-protected resource. No public exploit code was identified in the provided data.