CVE-2026-102460: Maven/io.vertx/vertx-web vulnerability
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated on the routing context by a preceding handler in the request pipeline, ChainAuthHandler skips all scope validation configured via withScope() or withScopes(). This affects both any() and all() chain modes.
The root cause is that postAuthentication() relies on internal state that is only set during the authenticate() phase, which is skipped entirely for pre-authenticated users. In any() mode, the absence of this state causes the method to fall through without delegating scope checks to any handler. In all() mode, scope checks are unconditionally skipped.
This allows a user with a valid token but insufficient scopes to access resources protected by scope requirements, provided they were authenticated by an earlier handler in the pipeline. The most common trigger is overlapping authentication handlers on nested routes, where a parent route authenticates broadly and a child route uses a chain to enforce specific scopes.
The impacted component Maven coordinate is io.vertx:vertx-web
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Eclipse Vert.x Web in the affected version ranges are exposed when ChainAuthHandler is used with a scope-requiring handler such as JWTAuthHandler or OAuth2AuthHandler, and requests can reach it with an already authenticated routing context. This can occur with overlapping authentication handlers on nested routes, where a parent route authenticates broadly before a child route applies scope requirements.
What must an attacker have to exploit the bypass?
An attacker needs a valid token that authenticates successfully but does not contain the scopes required by the protected resource. The attacker must also reach a request path where an earlier handler has already authenticated the user before ChainAuthHandler performs its configured scope validation.
Are both ChainAuthHandler modes affected?
Yes. In any() mode, scope validation may not be delegated to any configured handler for pre-authenticated users; in all() mode, scope checks are unconditionally skipped for those users.
How can I identify potentially affected routes?
Review routes using ChainAuthHandler with withScope() or withScopes(), particularly where JWTAuthHandler or OAuth2AuthHandler is also configured earlier in the routing pipeline. Focus on nested or overlapping routes in which parent-level authentication can populate the routing context before child-level scope enforcement runs.