Eclipse Vert.x Web: Scope bypass in ChainAuthHandler
Summary
Eclipse Vert.x Web (io.vertx:vertx-web) versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9 and 5.2.0 contain a scope bypass in ChainAuthHandler. If a user is already authenticated by an earlier handler in the request pipeline, the chain skips the configured scope checks (withScope() or withScopes()) in both any() and all() modes. An attacker with a valid token but insufficient scopes can reach resources protected by scope requirements, which affects confidentiality and integrity. The issue applies to applications that combine chained authentication handlers with scope checks, for example nested routes with JWT or OAuth2 authentication.
Affected
- Eclipse Vert.x 4.0.0 to 4.5.34
- Eclipse Vert.x 5.0.0 to 5.0.12
- Eclipse Vert.x 5.1.0 to 5.1.9
- Eclipse Vert.x 5.2.0
Fixed in
- 4.5.35 (4.5.x line)
- 5.1.10 (5.1.x line; 5.1.9 should not be used)
- 5.2.1 (5.2.x line)
- 5.0.x: Unknown. No fixed release for the 5.0 line was found in the sources.
Workaround
No vendor workaround documented. Upgrading is the documented remedy.
- Until patched, review routes where a parent route authenticates and a child route relies on a chain for scope checks.
- Verify that scope requirements are enforced at the child route and remove redundant overlapping authentication handlers where possible.
Exploitation
- Not listed in the CISA KEV catalog.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public exploit or proof of concept found. This does not prove that none exists.
Our recommendation
- Identify applications that depend on io.vertx:vertx-web and check their versions against the fixed-version list.
- Upgrade to the fixed release on the relevant line, starting with internet-facing services that use JWT or OAuth2 scopes.
- Test scope enforcement after the upgrade, and review nested routes with overlapping authentication handlers in the meantime.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-2p39-cr56-w58j github.com
- Eclipse CVE assignment ticket #339 gitlab.eclipse.org
- Upstream fix pull request #2956 github.com
- Eclipse Vert.x 5.1.10 release blog vertx.io
- OSV entry CVE-2026-102460 osv.dev
- VulDB entry 420315 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:08.
Original description (NVD)
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated on the routing context by a preceding handler in the request pipeline, ChainAuthHandler skips all scope validation configured via withScope() or withScopes(). This affects both any() and all() chain modes. The root cause is that postAuthentication() relies on internal state that is only set during the authenticate() phase, which is skipped entirely for pre-authenticated users. In any() mode, the absence of this state causes the method to fall through without delegating scope checks to any handler. In all() mode, scope checks are unconditionally skipped. This allows a user with a valid token but insufficient scopes to access resources protected by scope requirements, provided they were authenticated by an earlier handler in the pipeline. The most common trigger is overlapping authentication handlers on nested routes, where a parent route authenticates broadly and a child route uses a chain to enforce specific scopes. The impacted component Maven coordinate is io.vertx:vertx-web
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.