cve.bz

CVE-2026-110003

Azul Payara Administration REST Interface Authentication Bypass via X-GlassFish-authToken Header Leading to Remote Code Execution

9.3 critical

Critical (9.3) in azul payara payara server.

On this page
A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waives the remote-rejection check before the token is validated, and an invalid token falls through to password-based authentication, which succeeds without credentials on default domains configured with an empty administrative password. Successful exploitation grants execution of arbitrary administrative commands, equivalent to complete compromise of the server.

Severity

CVSS 4.0

9.3 critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE
CWE-288 Authentication Bypass Using an Alternate Path or Channel
OWASP Top 10
A07:2025 Authentication Failures
Published
Assigned by
Payara (CNA)
NVD analysis
Awaiting analysis
Record from
the NVD, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-110003 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-110003?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-110003?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-110003 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Affected

  • azul payara:payara server

Versions

From the CNA's record in the CVE List.

ProductAffected
Azul Payara Payara Serverfrom 7.0.0 before 7.6.0
Azul Payara Payara Serverfrom 7.2024.1.Alpha1 before 7.2026.11
Azul Payara Payara Serverfrom 6.0.0 before 6.44.0
Azul Payara Payara Serverfrom 6.2022.1 through 6.2025.11
Azul Payara Payara Serverfrom 5.20.0 before 5.93.0
Azul Payara Payara Serverfrom 5.181 through 5.201.2
Azul Payara Payara Serverfrom 5.2020.2 through 5.2022.5
Azul Payara Payara Serverfrom 4.1.2.191 before 4.1.2.191.61

Attack patterns (CAPEC)

  • CAPEC-127 Directory Indexing Likelihood: High · Severity: Medium
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.

References

Check your stackJSON