CVE-2026-60915

Vulnerability in Helidon (component WebSocket) affecting versions 4.0.0-4.5.5 and 27.0.0. Allows unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of Helidon data.

Vulnerability in Helidon (component helidon-webclient) affecting versions 4.0.0-4.5.5 and 27.0.0. Allows unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of Helidon data.

Vulnerability in Helidon (component helidon-integrations-vault) affecting versions 4.0.0-4.5.5. Allows unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of Helidon data; attacks may significantly impact additional products (scope change).

Vulnerability in Helidon (component helidon-security-providers-jwt) affecting versions 4.0.0-4.5.5 and 27.0.0. Allows unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of Helidon data; attacks may significantly impact additional products (scope change).

Vulnerability in Helidon (component helidon-security-providers-google-login) affecting versions 4.0.0-4.5.5. Allows unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of Helidon data.

Vulnerability in the Helidon product (component: helidon-cors) affecting versions 4.0.0-4.5.5. A difficult to exploit vulnerability requires human interaction and allows an unauthenticated attacker with network access via HTTP to gain unauthorized update, insert or delete access to some data.

Vulnerability in the Helidon product (component: LRA) affecting versions 4.0.0-4.5.5. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of Helidon accessible data.

Vulnerability in Oracle Fusion Middleware's Helidon product (component: OIDC) affecting versions 4.0.0-4.5.5 and 27.0.0. A difficult-to-exploit flaw allows an unauthenticated network attacker via HTTP to access critical data and modify some Helidon data, requiring user interaction and potentially impacting additional products.

Vulnerability in Oracle Fusion Middleware's Helidon product (component: helidon-security-providers-http-auth) affecting versions 3.0.0-3.2.21, 4.0.0-4.5.5 and 27.0.0. A difficult-to-exploit flaw allows an unauthenticated network attacker via HTTP to gain unauthorized access to critical Helidon data, potentially impacting additional products.

Vulnerability in Oracle Fusion Middleware's Helidon product (component: helidon-security-providers-idcs-mapper) affecting versions 3.0.0-3.2.21 and 4.0.0-4.5.5. A difficult-to-exploit flaw allows a low-privileged attacker logged into the infrastructure to gain unauthorized access to critical Helidon data, potentially impacting additional products.