A vulnerability in the Helidon security provider for HTTP authentication enables an unauthenticated attacker to trigger a scope change that results in unauthorized access to confidential data stored in Helidon services. The flaw exists in the authentication component and is difficult to exploit but, once triggered, it allows the attacker to read any data that the Helidon instance exposes over HTTP. The impact is limited to confidentiality; integrity and availability are not affected, but the scope change indicates a privilege escalation within the Helidon environment.

The affected product is Oracle Helidon, part of Oracle Fusion Middleware. Versions impacted include Helidon 3.0.0 through 3.2.21, 4.0.0 through 4.5.5, and the 27.0.0 release. The flaw resides specifically in the helidon-security-providers-http-auth component.

The CVSS v3.1 base score is 6.8, indicating a medium severity. EPSS is not available and the vulnerability is not listed in CISA KEV. The attack vector is an unauthenticated network connection over HTTP, requiring the attacker to access the Helidon instance from the network. Because the vector is network‑based and the impact is confidentiality, the exploitation likelihood is modest, and the risk is primarily relevant to systems that expose Helidon over public or untrusted networks.