A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.
Last checked: 2026-10-20 15:45 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-18 16:43 UTC)
Fix evidence last checked: 2026-10-20 14:26 UTC