This vulnerability affects multiple versions of Payara Server's Admin GUI, specifically the DownloadServlet and related ContentSource implementations. An attacker can exploit a SSRF flaw combined with missing CSRF protections to cause a logged-in administrator to leak their REST session token to an attacker-controlled server. The stolen token can then be replayed to gain full administrative access to the Payara domain, allowing arbitrary code execution through WAR deployment. The affected components include DownloadServlet and ContentSource implementations such as LogViewerContentSource, LogFilesContentSource, LBConfigContentSource, and ClientStubsContentSource within the admingui:console-common module.

Successful exploitation leads to full unauthenticated administrative takeover of the Payara Server admin domain. This includes the ability to execute arbitrary code by deploying malicious WAR files. The vulnerability compromises the confidentiality and integrity of the administrative session and the server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented at this time. Until a patch is available, restrict access to the Admin GUI to trusted administrators only and avoid interacting with untrusted content while logged into the admin interface.