CVE-2026-85511 — Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2
A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due …
Published: 2026-09-18 · CVSS: 4.2 · CVSS 3.1
A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7