{"affected":[{"defaultStatus":"unaffected","product":"Payara Server","source":"CNA: Payara","vendor":"Azul Payara","versions":[{"lessThan":"7.6.0","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThan":"7.2026.11","status":"affected","version":"7.2024.1.Alpha1","versionType":"custom"},{"lessThan":"6.44.0","status":"affected","version":"6.0.0","versionType":"semver"},{"lessThanOrEqual":"6.2025.11","status":"affected","version":"6.2022.1","versionType":"custom"},{"lessThan":"5.93.0","status":"affected","version":"5.20.0","versionType":"semver"},{"lessThanOrEqual":"5.201.2","status":"affected","version":"5.181","versionType":"custom"},{"lessThanOrEqual":"5.2022.5","status":"affected","version":"5.2020.2","versionType":"custom"},{"lessThan":"4.1.2.191.61","status":"affected","version":"4.1.2.191","versionType":"custom"}]}],"cveId":"CVE-2026-110003","cwes":["CWE-288"],"description":"A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waives the remote-rejection check before the token is validated, and an invalid token falls through to password-based authentication, which succeeds without credentials on default domains configured with an empty administrative password. Successful exploitation grants execution of arbitrary administrative commands, equivalent to complete compromise of the server.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.3,"severity":"critical","source":"CNA: Payara","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794472999548,"publishedAt":1794472999548,"references":[{"source":"CNA: Payara","tags":[],"url":"https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.61.html"},{"source":"CNA: Payara","tags":[],"url":"https://docs.azul.com/payara/version/5/release-notes/release-notes-5.93.0.html"},{"source":"CNA: Payara","tags":[],"url":"https://docs.azul.com/payara/version/6/release-notes/release-notes-6.44.0.html"},{"source":"CNA: Payara","tags":[],"url":"https://docs.azul.com/payara/release-notes/release-notes-7.6.0.html"},{"source":"CNA: Payara","tags":[],"url":"https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.11.html"}],"remediation":[],"revision":"65ea64b47a5e2d4684ea662260b35fab407205378770084474e98c61fe6d36f5","sources":[{"modifiedAt":1794472999548,"name":"CNA: Payara","retrievedAt":1794474499791,"url":"https://www.cve.org/CVERecord?id=CVE-2026-110003"}],"ssvc":null,"status":"published","title":"Azul Payara Administration REST Interface Authentication Bypass via X-GlassFish-authToken Header Leading to Remote Code Execution","updatedAt":1794474499791}