CVE-2026-101574: CSRF
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: OIDC). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data as well as unauthorized update, insert or delete access to some of Helidon accessible data. CVSS 3.1 Base Score 6.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N).
Affected Software
Event History
Frequently Asked Questions
Which Helidon deployments are affected?
Affected supported versions are 4.0.0 through 4.5.5 and 27.0.0. The affected component is OIDC.
What does an attacker need to exploit this issue?
An unauthenticated attacker needs network access to the target over HTTP. Exploitation is difficult and requires interaction by a person other than the attacker.
What could a successful attack allow?
A successful attack may provide unauthorized access to critical data or complete access to data accessible through Helidon. It may also permit unauthorized update, insertion, or deletion of some Helidon-accessible data.
Can the impact extend beyond the Helidon deployment?
Yes. The vulnerability has scope change, meaning a successful attack may significantly affect additional products.