The Helidon product’s OIDC component contains a flaw that permits an unauthenticated attacker with HTTP network access to compromise the application. Attack execution requires human interaction from an individual other than the attacker, yet successful exploitation can lead to unauthorized read access to critical data, full access to all Helidon‑exposed information, and update, insert or delete operations on protected data. The vulnerability therefore impacts confidentiality and integrity of the affected systems.

Oracle Helidon versions 4.0.0 through 4.5.5 and 27.0.0 are affected. The flaw resides in the Helidon OIDC component, part of Oracle Fusion Middleware, and can extend to other products that interact with Helidon, potentially changing the scope of the compromise.

The CVSS 3.1 base score of 6.9 indicates a moderate to high severity risk. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. The attack vector is inferred to be remote network access over HTTP; however, the need for accidental human interaction reduces the likelihood of automatic exploitation. Nevertheless, the potential for confidential data exposure and unauthorized data modification warrants immediate attention.