CVE-2026-85511

Executive Summary

CVE-2026-85511 is a parameter substitution vulnerability (CWE-290: Authentication Bypass by Spoofing) affecting Red Hat JBoss Enterprise Application Platform (EAP) applications that use an Elytron token-realm configured with oauth2-introspection. The flaw arises because a missing URL encoding step allows parameters to be substituted into the OAuth2 introspection request in a way an attacker can influence, potentially causing the introspection endpoint to mishandle the submitted token during authorization decisions. With a CVSS base score of 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), impact is bounded to partial confidentiality and integrity loss under a high attack-complexity, low-privilege precondition, and no vendor patch has been identified as of this report.

Technical Analysis

The vulnerability resides in the interaction between a JBoss EAP application's security domain and an Elytron token-realm whose token validation strategy is OAuth2 token introspection (oauth2-introspection). In this model, the application delegates bearer-token validation to an external OAuth2 authorization server via an introspection endpoint rather than verifying a JWT signature locally. The realm must therefore construct an HTTP request (typically an RFC 7662-style introspection call) that carries the token — and possibly other parameters — from the incoming client request.

The NVD description states the flaw directly: "An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding." This is the entire authoritative technical detail provided, and the report will not extrapolate beyond it.

The root cause class is CWE-290 (Authentication Bypass by Spoofing), realized here through missing URL encoding of parameters placed into the outbound introspection request. URL encoding (percent-encoding) is the canonical defense against parameter injection / parameter pollution in HTTP query strings and form bodies. When a value is interpolated into a request without encoding, reserved delimiter characters — &, =, #, ?, % — retain their structural meaning instead of being treated as literal data. An attacker who can place such characters into an input that the realm forwards onward can therefore break out of the intended parameter slot and introduce or modify parameters.

Because the affected realm performs introspection as part of a security-domain authorization decision, the consequence of successful parameter substitution is a class-level spoofing / authentication-bypass risk: the introspection request no longer faithfully represents the client's original credential material, and the authorization server's response may be computed on attacker-influenced input. This matches the CWE-290 categorization (bypass by spoofing) rather than a generic injection class.

Attack surface and preconditions:

• Network-reachable (AV:N): the flaw is exploitable remotely against a deployed application.
• High complexity (AC:H): the CVSS vector assigns AC:H, indicating that success depends on conditions outside the attacker's direct control — consistent with the need for a specific realm configuration (oauth2-introspection), a specific trusted relationship with the introspection endpoint, and attacker control over a parameter that the realm fails to encode.
• Low privileges (PR:L): the attacker operates from a low-privilege authenticated (or held-token) position rather than being fully unauthenticated.
• No user interaction (UI:N): exploitation does not require a victim to perform an action.
• Scope unchanged (S:U): the impact stays within the application's security authority.

Note on token handling: the missing encoding is a property of how the realm builds its outbound introspection request, not of the OAuth2 protocol itself. As no function names, class names, or source locations are disclosed in the provided data, this report deliberately does not name specific Elytron classes, methods, or endpoints.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE (PoC/Exploit: None). The following attack chain is therefore inferred from the vulnerability class (CWE-290 / parameter substitution via missing URL encoding) and the stated realm configuration; it is not derived from any disclosed exploit or code.

1. Reconnaissance / target identification. The attacker identifies a JBoss EAP–hosted application that returns HTTP 401/WWW-Authenticate challenges typical of OAuth2 bearer-token enforcement, and determines — through observable behavior, documentation, or configuration exposure — that the application's security domain is backed by an Elytron token-realm using oauth2-introspection. Targets reachable by Shodan-style queries for EAP management surfaces help narrow the population of candidate hosts.

2. Triggering the specific flaw class. The attacker submits a request carrying a bearer token whose value (or an adjacent value the realm forwards into the introspection request) contains reserved delimiter characters such as &, =, or # instead of their percent-encoded equivalents. Because the realm performs missing URL encoding when assembling the outbound introspection call, those characters are interpreted structurally by the downstream introspection endpoint rather than as part of the literal value.

3. Parameter substitution at the vulnerability-class level. The unencoded delimiters allow the attacker to substitute or append parameters in the introspection request, i.e., to shift the meaning of the request away from the single intended token parameter. This is parameter injection/pollution achieved by the absence of encoding — the defining mechanism of this CVE. The attacker is thus positioned to influence the query the authorization server evaluates, in service of a spoofing objective consistent with CWE-290.

4. Post-exploitation impact. Successful parameter substitution undermines the integrity of the authentication/authorization decision the introspection call is meant to produce, potentially allowing bypass of intended token validation or access control. Consistent with the CVSS impact subscores (C:L/I:L/A:N), the outcome is partial — limited disclosure or modification within the application's authority — rather than full compromise or loss of availability.

Because the description does not disclose the exact parameter name, URL structure, or request format involved, no specific payload string, endpoint path, or parameter identifier is asserted here.

Impact Assessment

• Confidentiality (C:L — Low): some information accessible to an authenticated application user may be exposed through a weakened authorization decision.
• Integrity (I:L — Low): attacker-influenced introspection input may lead to decisions that permit minor unauthorized state changes.
• Availability (A:N — None): the flaw does not produce a denial-of-service condition.
• Attack Vector (AV:N): exploitable over the network; low barrier for initial reach.
• Attack Complexity (AC:H): success requires the specific oauth2-introspection realm configuration and attacker control of a parameter the realm fails to encode.
• Privileges Required (PR:L): a low-privilege position is a precondition.
• User Interaction (UI:N): no victim action is needed.
• Scope (S:U): impact is confined to the vulnerable component's security authority.

Business impact. Affected systems are JBoss EAP deployments whose security domains delegate token validation to an Elytron token-realm with oauth2-introspection. Because this configuration is common in SSO/OIDC-gated enterprise applications, the blast radius is proportional to how widely that realm pattern is deployed for externally reachable applications. A weakened introspection/authorization decision can translate into degraded trust in the application's authentication boundary, with potential unauthorized data access or modification bounded (per CVSS) to partial confidentiality and integrity effects. The high attack complexity and the absence of a public exploit (no PoC, no Nuclei template, no KEV listing) moderate near-term operational urgency, but the absence of any patch (0/4 confidence) raises the risk ceiling over time.

Detection Guidance

Sigma Rule

title: Potential Elytron OAuth2 Introspection Parameter Substitution (CVE-2026-85511)
id: 7f2a1c9e-8551-4b6d-9c2e-202685511cve
status: experimental
description: Detects requests containing suspicious delimiter sequences in bearer tokens or query parameters that may indicate parameter substitution against Red Hat JBoss EAP Elytron oauth2-introspection token-realms (missing URL encoding, CWE-290).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85511
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.290
logsource:
  category: webserver
detection:
  selection_delims:
    cs-uri-query|contains:
      - '%26'
      - '%3D'
      - '&'
      - 'token='
  selection_introspection:
    cs-uri-query|contains:
      - 'token_type'
      - 'assertion'
      - 'oauth2-introspection'
  condition: selection_delims and selection_introspection
fields:
  - c-ip
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate clients sending correctly encoded tokens containing reserved characters
level: medium

YARA Rule

rule CVE_2026_85511_Elytron_OAuth2_Param_Substitution
{
    meta:
        description = "Detects JBoss EAP Elytron oauth2-introspection configuration referencing token-realm and introspection endpoint (CVE-2026-85511)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85511"
        date = "2026-01-01"
        severity = "medium"
        cve = "CVE-2026-85511"
    strings:
        $realm = "oauth2-introspection" ascii nocase
        $tokrealm = "token-realm" ascii nocase
        $introspect = "introspection" ascii nocase
        $elytron = "elytron" ascii nocase
    condition:
        ($realm and $tokrealm) or ($elytron and $introspect and $tokrealm)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85511 Attempted OAuth2 Introspection Parameter Substitution (Elytron)"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/"; http.uri; content:"token"; nocase; http.uri; content:"&"; http.uri; content:"="; pcre:"/(token|assertion)=[^\x26]*(%26|\x26|%3D)/i"; reference:cve,CVE-2026-85511; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-85511; classtype:attempted-user; sid:202685511; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where http.request.method == "GET" and
     stringContains(http.request.uri, "token") and
     stringContains(http.request.uri, "&") and
     stringContains(http.request.uri, "=")]
  [http where url.query contains "token_type" or
            url.query contains "assertion"]

Splunk SPL Query

index=web OR index=proxy sourcetype=*access*
| search uri_path=*token* OR uri_query=*oauth*
| eval suspicious=if((match(uri_query,"(&|=)") OR match(uri_query,"%26|%3D")),1,0)
| where suspicious=1
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_query) as sample_query by src_ip, dest_host
| where count > 3
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="web,cve-2026-85511,">
  <rule id="100551" level="10">
    <if_sid>31100</if_sid>
    <match>token</match>
    <regex type="pcre2">(?i)(token|assertion)=[^&amp;]*(%26|&amp;|%3D)</regex>
    <description>CVE-2026-85511: Possible OAuth2 introspection parameter substitution attempt (Elytron missing URL encoding)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source; Vendor Fix: N/A; Workarounds: N/A; no affected version ranges or OSV packages are disclosed.

1. Immediate mitigations (no vendor patch available):

   • Reduce exposure: Restrict network reachability of applications using Elytron oauth2-introspection token-realms to trusted clients; place them behind authenticated gateways/WAFs.
   • Detect the behavior: Deploy the rules above to flag inbound requests whose token/parameter values contain un-encoded reserved delimiters (&, =, #) targeting introspection-backed endpoints.
   • Review realm configuration: Inventory all EAP security domains backed by token-realms with oauth2-introspection. Where introspection is optional, prefer locally verifiable token validation (e.g., JWT signature validation) to remove the affected code path.
   • Least privilege / token hygiene: Because PR:L is required, tighten token issuance and scope so low-privilege tokens cannot reach introspection-backed surfaces unnecessarily.

2. Patch / upgrade steps: Monitor Red Hat Product Security and the Red Hat JBoss EAP advisory channel for an official fix addressing CVE-2026-85511. When released, apply the RHBZ/security advisory to the affected EAP version and re-test the oauth2-introspection realm flows. Until then, no verified upgrade target exists.

3. Long-term hardening:

   • Enforce strict, uniform URL/percent-encoding of all values interpolated into outbound OAuth2 introspection requests (fixes the missing-encoding root cause at the design level).
   • Adopt a policy of validating and canonicalizing inbound token material before it is forwarded to any external service.
   • Add regression tests that assert reserved characters in token material are encoded in outbound calls.
   • Track CWE-290 patterns during secure code review of identity/realm integration code.

References

1. NVD — CVE-2026-85511: https://nvd.nist.gov/vuln/detail/CVE-2026-85511
2. MITRE CWE-290 — Authentication Bypass by Spoofing: https://cwe.mitre.org/data/definitions/290.html
3. FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-85511 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. Red Hat Product Security advisories / JBoss EAP (monitor for official fix): https://access.redhat.com/security/

Exploitation-in-the-wild status: No public PoC, no exploit code, no Nuclei template, and no CISA KEV listing for CVE-2026-85511 have been identified in the provided data. No threat-actor campaign is associated with this CVE at this time. All exploitation content in this report is inferred from the disclosed vulnerability class (CWE-290, parameter substitution via missing URL encoding) and should be treated as analytical assessment rather than observed activity.