Oracle Helidon EUVD-2026-105986

Exploitation requires the target Helidon application (versions 4.0.0 through 4.5.5) to have the helidon-security-providers-google-login security provider configured and in use - applications not using Google-login-based security via this provider are not affected. Within that configuration the flaw is remotely and unauthenticatedly reachable over HTTP (AV:N/AC:L/PR:N/UI:N), so there are no user-interaction or credential prerequisites; the primary limiting factors are (1) use of this specific optional component and (2) the narrow impact, which is read-only access to a subset of data (C:L) with no write or availability effect.

This is a moderate, not high-priority, issue. The CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - network-reachable, low complexity, no privileges or user interaction, but the only impact is LOW confidentiality (unauthorized read access to a subset of Helidon data); there is no integrity or availability impact and no scope change. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization. One conflict to verify: the input Tags include 'Authentication Bypass', which implies a security-control bypass, yet the Oracle description and CVSS characterize the flaw only as limited unauthorized read access (C:L, I:N) rather than a full authentication bypass - treat the 'Authentication Bypass' label with caution and rely on the vendor CVSS/description. Overall this reads as a genuine-but-low-severity information-exposure bug in a specific optional component, worth patching in normal cycles rather than as an emergency.

An attacker with network access sends crafted HTTP requests to a Helidon application that has the Google login security provider configured, and without authenticating obtains read access to a limited subset of data exposed by Helidon. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are needed, but no public exploit code is identified at time of analysis.