CVE-2026-85511: EAP Elytron Auth Bypass Vulnerability

CVE-2026-85511 Overview

CVE-2026-85511 is a flaw in Red Hat JBoss Enterprise Application Platform (EAP) affecting the Elytron security subsystem. The vulnerability exists in applications whose security domain is backed by an Elytron token-realm configured with oauth2-introspection. Missing URL encoding of user-supplied values permits parameter substitution when the introspection request is constructed. The weakness is categorized under [CWE-290: Authentication Bypass by Spoofing]. Red Hat has issued advisories RHSA-2026:70228, RHSA-2026:70229, RHSA-2026:70230, and RHSA-2026:70277 to address impacted EAP releases.

Critical Impact
An authenticated attacker can manipulate OAuth2 introspection request parameters, potentially influencing token validation outcomes and impacting confidentiality and integrity of the authentication flow.

Affected Products

Red Hat JBoss Enterprise Application Platform (EAP) with Elytron token-realm
EAP security domains using OAuth2 introspection endpoints
Downstream Red Hat products referenced in advisories RHSA-2026:70228, RHSA-2026:70229, RHSA-2026:70230, and RHSA-2026:70277

Discovery Timeline

2026-09-18 - CVE-2026-85511 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-85511

Vulnerability Analysis

The flaw resides in the Elytron token-realm implementation that integrates with OAuth2 introspection endpoints. When EAP validates a bearer token, it issues an introspection request to the configured authorization server. Elytron constructs the request body using values derived from client-supplied input without applying URL encoding. An attacker who can influence those values can inject additional parameters into the application/x-www-form-urlencoded payload. This parameter substitution alters the introspection request and can affect how the authorization server interprets the query. The result is a spoofing weakness in the token validation path aligned with [CWE-290].

Root Cause

The root cause is missing URL encoding of untrusted input incorporated into the OAuth2 introspection request. Special characters such as & and = pass unescaped into the form-encoded body, allowing additional key/value pairs to be smuggled alongside the intended token parameter.

Attack Vector

Exploitation requires network access to the EAP application and low-privilege authentication context. The high attack complexity reflects reliance on specific token-realm configurations and the ability to shape a token value or related field that reaches the introspection client. Successful exploitation impacts token validation semantics rather than yielding direct code execution.

No verified public proof-of-concept code is available. See the Red Hat CVE-2026-85511 advisory and Red Hat Bug Report #2483140 for further technical details.

Detection Methods for CVE-2026-85511

Indicators of Compromise

Unexpected additional parameters appearing in OAuth2 introspection request bodies logged by the authorization server.
Introspection requests containing unescaped & or = characters within the token field value.
Anomalous authentication successes for tokens that should have been rejected by the identity provider.

Detection Strategies

Enable verbose logging on the OAuth2 introspection endpoint and inspect raw request bodies for parameter injection patterns.
Correlate EAP Elytron authentication events with authorization-server introspection responses to identify mismatched decisions.
Deploy web application firewall rules that flag reserved URL characters embedded within bearer token values presented to EAP.

Monitoring Recommendations

Monitor Elytron audit logs for authentication events tied to token-realm security domains.
Alert on repeated introspection failures followed by successful authentications from the same client.
Track configuration drift on EAP security domains to detect unauthorized oauth2-introspection changes.

How to Mitigate CVE-2026-85511

Immediate Actions Required

Inventory all EAP deployments using Elytron token-realm with oauth2-introspection and prioritize them for patching.
Apply the fixed packages delivered in RHSA-2026:70228, RHSA-2026:70229, RHSA-2026:70230, or RHSA-2026:70277 matching your EAP release.
Rotate any bearer tokens or client credentials that may have transited a vulnerable introspection flow.

Patch Information

Red Hat has released patches through the following advisories: RHSA-2026:70228, RHSA-2026:70229, RHSA-2026:70230, and RHSA-2026:70277. Administrators should consult the Red Hat CVE-2026-85511 advisory to map affected components to the correct erratum.

Workarounds

Where patching is not immediately possible, restrict access to EAP applications relying on oauth2-introspection to trusted network segments.
Enforce strict input validation on any client-facing field that can propagate into the token introspection request.
Consider temporarily switching the security domain to a non-OAuth2 realm until the patched EAP release is deployed.

bash

# Configuration example
# See Red Hat advisories for exact remediation steps for your EAP version