A vulnerability exists in the Helidon security provider that interfaces with Google Login. An unauthenticated attacker with access to the Helidon instance over HTTP can exploit this flaw to read a subset of Helidon‑exposed data. The flaw does not allow for code execution or denial of service; it primarily impacts confidentiality through information disclosure.

The affected product is Oracle Helidon, within the Helidon security providers component for Google login. Versions 4.0.0 through 4.5.5 are impacted. Systems running these Helidon releases and exposing the Google login endpoint are vulnerable.

The CVSS v3.1 base score is 5.3, indicating moderate potential for data exposure. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be unauthenticated network access over HTTP, which is typically reachable from the internet or corporate perimeter. Successful exploitation would grant an attacker read access to data that Helidon is configured to expose through the vulnerable login provider.