Helidon, a component of Oracle Fusion Middleware, contains an unauthenticated HTTP‑exposed endpoint in the WebClient WebSocket module. An attacker can send requests without credentials, causing the application to return a subset of accessible data and to generate a partial denial of service. The CVSS 3.1 base score is 6.5, indicating moderate confidentiality and availability impacts for an unauthenticated user.

Oracle Helidon is impacted. Versions 4.0.0 through 4.5.5 and 27.0.0 are affected. The vulnerability exists in the helidon-webclient-websocket package of these releases.

The CVSS score of 6.5 reflects that the vulnerability presents moderate risk. The EPSS score is < 1% and the issue is not listed in the CISA KEV catalog, suggesting limited observed exploitation. The likely attack vector is over HTTP, requiring network access to the affected Helidon instance and giving the attacker read access and the ability to destabilize the service.