Threats affecting pkg:maven/com.payara/server/payara-server

CVE-2026-110003 is a critical authentication bypass vulnerability in the administration REST interface of Azul Payara Payara Server. It allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. This bypass leads to password-based authentication succeeding without credentials on default domains configured with an empty administrative password. Successful exploitation grants execution of arbitrary administrative commands, effectively compromising the entire server.