Oracle Helidon EUVD-2026-105982

Exploitation targets the OIDC (OpenID Connect) component of Helidon and requires the attacker to be network-adjacent over HTTP with no authentication (PR:N), but it is gated by two concrete limiting factors: high attack complexity (AC:H), meaning the attacker must win specific conditions or timing outside their direct control, and mandatory interaction from a human victim other than the attacker (UI:R) - typically luring a legitimate user to act on a crafted OIDC request/response during an authentication flow. The scope change (S:C) means impact can extend to products integrated with the affected Helidon service. Realistic risk is therefore constrained to deployments using Helidon's OIDC security feature and to scenarios where an attacker can reliably induce victim interaction; it is not exploitable against a default, unused-OIDC configuration without user involvement.

This is a moderate-severity issue (CVSS 3.1 base 6.9) that should be prioritized as standard patch-cycle work rather than an emergency. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N) shows a mixed risk profile: it is network-reachable and unauthenticated (AV:N, PR:N), which raises exposure, but two strong mitigating factors pull real-world risk down - high attack complexity (AC:H) and required user interaction from a person other than the attacker (UI:R). The scope change (S:C) and high confidentiality impact (C:H) are the main severity drivers, with only low integrity impact (I:L) and no availability impact (A:N). No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'Authentication Bypass' tag is not clearly substantiated by the description, which emphasizes confidentiality/integrity data access in the OIDC component via a user-interaction-driven flow rather than an explicit authentication bypass - treat that tag with caution and verify against the Oracle CPU advisory. Overall: a real but not urgent issue; the AC:H and UI:R requirements make broad, automated exploitation unlikely, favoring targeted scenarios.

An attacker crafts a malicious HTTP request or link targeting the OIDC authentication flow of a Helidon-based application and lures a legitimate user into interacting with it. Because of the scope change, a successful attack can leak sensitive data and make limited unauthorized modifications affecting not just Helidon but additional downstream products relying on it. Exploitation is rated difficult (AC:H) and depends on winning the required user-interaction condition; no public exploit code is known.