EUVD Vulnerability Catalog

EUVD-2026-124331

Severity: CRITICAL Base Score: 9.3 CVSS Version: 4.0

Vulnerability Description

A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waives the remote-rejection check before the token is validated, and an invalid token falls through to password-based authentication, which succeeds without credentials on default domains configured with an empty administrative password. Successful exploitation grants execution of arbitrary administrative commands, equivalent to complete compromise of the server.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

▪ Attack Vector (AV): Network
▪ Attack Complexity (AC): Low
▪ Attack Requirements (AT): None
▪ Privileges Required (PR): None
▪ User Interaction (UI): None
▪ Vulnerability Confidentiality Impact (VC): High
▪ Vulnerability Integrity Impact (VI): High
▪ Vulnerability Availability Impact (VA): High
▪ Subsequent Confidentiality Impact (SC): None
▪ Subsequent Integrity Impact (SI): None
▪ Subsequent Availability Impact (SA): None

Affected Vendors & Systems

Vendor Azul Payara

References & Advisory Links

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

Payara

EPSS Probability

0

Known Aliases
CVE-2026-110003 GHSA-gv3m-v36g-qfr6
Published On

2026-11-12

Last Updated

2026-11-12