EUVD-2026-38793
GHSA-x939-7fq5-v9v6
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:M/U:Amber
Browser-delivered CSRF/SSRF is network-reachable (AV:N); needs a logged-in admin victim to be tricked, so UI:R and AC:H; PR:N as the attacker is unauthenticated; stolen token enabling REST RCE changes scope (S:C) with full C/I/A impact.
Primary rating from Vendor (Payara).
CVSS VectorVendor: Payara
Lifecycle Timeline
2DescriptionCVE.org
A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can result in a full unauthenticated takeover of Payara admin domain.
A Server-Side Request Forgery (SSRF) vulnerability in the DownloadServlet of the Admin GUI in Payara Server allows a remote attacker to exfiltrate the administrator's REST session token (gfresttoken) to an attacker-controlled host via a crafted request URL. Combined with the absence of CSRF protection on DownloadServlet, an unauthenticated attacker can trick a logged-in administrator into triggering the token leak, then replay the stolen token to gain full administrative access to the Payara domain, leading to arbitrary code execution via WAR deployment. The vulnerability exists in the DownloadServlet and associated ContentSource implementations (LogViewerContentSource, LogFilesContentSource, LBConfigContentSource, ClientStubsContentSource) within the admingui:console-common module.
AnalysisAI
Full unauthenticated administrative takeover of Payara Server Full (4.x through 7.2026.x, including 6.2024.x and 6.2025.x) is achievable by chaining a Server-Side Request Forgery in the Admin GUI's DownloadServlet with the absence of CSRF protection (CWE-352). An attacker who lures a logged-in administrator into a crafted request exfiltrates the admin REST session token (gfresttoken) to an attacker-controlled host, then replays it for full domain control and arbitrary code execution via WAR deployment. The CVSS 4.0 vector carries E:P (proof-of-concept maturity), so publicly available exploit code exists; there is no CISA KEV listing and no EPSS score in the provided data.
Technical ContextAI
Payara Server is a Jakarta EE / MicroProfile application server derived from GlassFish, used to host enterprise Java web applications; administration runs through the Admin GUI (admingui:console-common module) and a REST management interface authenticated by the gfresttoken session token. The root-cause class is CWE-352 (Cross-Site Request Forgery): the DownloadServlet lacks CSRF tokens, and its associated ContentSource implementations (LogViewerContentSource, LogFilesContentSource, LBConfigContentSource, ClientStubsContentSource) accept attacker-influenced URLs, producing a Server-Side Request Forgery primitive. Because the servlet fetches/forwards content to an attacker-supplied destination while operating in the authenticated admin's browser context, the privileged gfresttoken can be redirected to an external host, and that token grants the same capabilities as the admin REST API - including application (WAR) deployment, which yields code execution.
RemediationAI
Vendor-released patch: Payara Server 7.2026.6 (per the Payara Community Release Notes at https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%207.2026.6.html); upgrade to the patched build for your branch and verify backported fixes for the 6.2024.x, 6.2025.x, 5.x, and 4.x lines directly with Payara, since several of those branches are older or may be end-of-support. Until patched, restrict network exposure of the Admin GUI/admin listener (default port 4848) to a management VLAN or localhost and require VPN/jump-host access - this prevents the crafted request from reaching the console but also blocks remote administration. Enforce that administrators do not browse untrusted sites while an admin console session is open and that they log out when finished, shrinking the window in which a valid gfresttoken can be stolen. Optionally front the console with a reverse proxy that validates Referer/Origin and adds anti-CSRF enforcement on DownloadServlet paths, accepting that overly strict proxy rules can break legitimate console downloads such as the log viewer, client stubs, and load-balancer config retrieval.
Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different
Payara Micro Community 5.2021.6 and below allows Directory Traversal. Rated high severity (CVSS 7.5), this vulnerability
A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterpris
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Payara Plat
Payara through 5.2022.2 allows directory traversal without authentication. Rated high severity (CVSS 7.5), this vulnerab
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Inte
CVE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Payara Pla
Payara Server ships by default without any cap on failed authentication attempts, so its administrative console and appl
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today