Helidon’s security‑providers‑jwt contains a flaw that lets an unauthenticated attacker with HTTP network access read a subset of Helidon‑exposed data. The vulnerability operates without granting credentials and can be exploited by sending a crafted request over the network. If successfully exploited, the attacker can obtain confidential information that should be restricted to authorized users, while integrity and availability are not affected.

Oracle Corporation’s Helidon product, versions 4.0.0 through 4.5.5 and 27.0.0, is affected. The issue resides in the helidon‑security‑providers‑jwt component and has the potential to impact other Oracle Fusion Middleware products through scope change.

The CVSS 3.1 base score is 5.8, indicating a moderate risk. The EPSS score is not reported, and the vulnerability is not listed in CISA KEV. Attacks are likely to be carried out via HTTP requests that exploit the JWT provider, allowing an attacker to read restricted data without authentication. There are no listed mitigations beyond patching, so the risk remains until a vendor update is applied.