EUVD-2026-53925
GHSA-325x-xm3p-mmv6
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote, low-complexity, no attacker auth (PR:N) but victim admin must interact (UI:R); token leak crosses the auth boundary (S:C) yielding full domain compromise (C:H/I:H/A:H).
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
3DescriptionCVE.org
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\> full unauthenticated takeover of Eclipse GlassFish domain until the token expires.
AnalysisAI
Server-Side Request Forgery combined with CSRF in Eclipse GlassFish's DownloadServlet ContentSources handler allows a remote attacker to exfiltrate the administrative gfresttoken to an attacker-controlled host when an authenticated administrator visits a malicious page. Affecting Eclipse GlassFish 8.0.x prior to 8.0.4, successful token theft yields full control of the GlassFish administrative domain until the token expires, effectively an unauthenticated takeover of the management plane. No public exploit identified at time of analysis, and the issue is not in CISA KEV, but the CVSS 9.6 rating and low attack complexity make it high priority.
Technical ContextAI
Eclipse GlassFish is the Jakarta EE (formerly Java EE) reference application server, and its Admin Console exposes a REST-based management interface protected by the session-bound gfresttoken. The root cause is CWE-918 (Server-Side Request Forgery): the DownloadServlet's ContentSources mechanism accepts a request that causes the server (or the admin's authenticated browser context) to make a request whose destination is attacker-influenced, so the sensitive management token is transmitted to an external host. The flaw is compounded by a Cross-Site Request Forgery weakness, meaning the malicious request is triggered by leveraging the victim administrator's already-authenticated Admin Console session rather than by the attacker directly authenticating. Because the leaked gfresttoken authorizes the full administrative REST API, its disclosure collapses the server's authentication boundary.
RemediationAI
Vendor-released patch: Eclipse GlassFish 8.0.4 - upgrade all 8.0.x deployments to 8.0.4 or later, which is the primary and complete fix. Until patching is possible, reduce exposure by restricting network access to the Admin Console so it is reachable only from trusted management networks or via VPN, and advise administrators not to browse untrusted web content within a session where they are logged into the Admin Console (mitigating the CSRF/UI:R trigger); note the trade-off that network restriction complicates legitimate remote administration. Because token theft grants domain-wide control, also consider shortening administrative session/token lifetimes to limit the window an exfiltrated gfresttoken remains valid, at the cost of more frequent admin re-authentication. Consult the Eclipse advisory at https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/445 for authoritative fix guidance.
More in Eclipse Glassfish
View allRemote code execution in Eclipse GlassFish allows remote attackers to evaluate arbitrary Expression Language (EL) expres
Remote code execution in Eclipse GlassFish allows attackers with administrative access to the Administration Console to
HTTP request smuggling in Eclipse Grizzly before 5.0.2 stems from the framework's inability to correctly parse malformed
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today