CVE-2026-102460: Vulnerability in Eclipse Foundation Eclipse Vert.x

Eclipse Vert.x Web's ChainAuthHandler has a scope bypass vulnerability in versions >=4.0.0 <=4.5.34, >=5.0.0 <=5.0.12, >=5.1.0 <=5.1.9, and =5.2.0. When used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler, if a user is already authenticated by an earlier handler in the request pipeline, ChainAuthHandler skips scope validation configured via withScope() or withScopes(). This is due to postAuthentication() relying on internal state set during authenticate(), which is not set for pre-authenticated users. In any() mode, missing state causes scope checks to be skipped; in all() mode, scope checks are unconditionally skipped. This allows users with valid tokens but insufficient scopes to access protected resources, especially in nested route scenarios with overlapping authentication handlers.

Users with valid authentication tokens but insufficient scopes can bypass scope validation and access resources protected by scope requirements. This undermines authorization controls in applications using Eclipse Vert.x Web's ChainAuthHandler with scope-requiring handlers, potentially exposing sensitive functionality or data. The vulnerability affects both any() and all() chain modes and is triggered when a user is pre-authenticated by an earlier handler in the request pipeline.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should review their routing configurations to avoid overlapping authentication handlers that cause pre-authentication before ChainAuthHandler scope checks. Consider restructuring route handlers to ensure scope validation is enforced or implement additional manual scope checks as a temporary mitigation.