The vulnerability exists in the Elytron token-realm with oauth2-introspection in Red Hat JBoss EAP 7. An application using this setup may allow parameter substitution due to missing URL encoding when forwarding tokens to an external IdP. This could lead to injection of additional data into the verification request. Despite this, authentication bypass is not feasible under standard IdP configurations because malformed tokens are rejected, and access control is enforced post-verification. Red Hat classifies this as a low-impact issue with a CVSS 3.1 score of 4.2.

The flaw could allow an attacker to inject additional data into the token verification request sent to an external IdP. However, since standard IdPs automatically reject malformed or invalid requests and the application server enforces role and access permissions after identity verification, the risk of authentication bypass or unauthorized access is minimal. Red Hat rates the overall security risk as low.

Red Hat has not indicated that a fix is currently available or required. The vulnerability is mitigated by standard IdP behavior rejecting malformed tokens and strict enforcement of access permissions within the application server. Users should monitor the Red Hat advisory for any future updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.