The reported vulnerability is a scope bypass flaw in Eclipse Vert.x Web's ChainAuthHandler. Because the handler does not validate authentication scopes for requests that have already been authenticated earlier in the processing pipeline, an attacker carrying a valid token that lacks the required scopes can reach endpoints that are intended to be protected by scope checks. This flaw arises from a logic error in the postAuthentication() method, which skips scope verification for pre‑authenticated users.

Affected by this issue are Eclipse Vert.x Web deployments built with Vert.x releases 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and the 5.2.0 release. Any application using the io.vertx:vertx-web Maven component in these ranges is vulnerable. The flaw is present when ChainAuthHandler is configured together with JWTAuthHandler or OAuth2AuthHandler that enforce scope requirements via withScope() or withScopes().

The potential impact is significant, reflected in a CVSS score of 8.6, in the high range. An attacker can exploit the flaw by sending a crafted HTTP request that contains a pre‑authenticated token, leveraging overlapping authentication handlers on nested routes. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Because the flaw is triggered by network traffic to the application and requires only a valid but insufficient token, the likelihood of exploitation in the wild is moderate to high in exposed deployments. The precise attack vector is inferred to be remote network via HTTP, as the vulnerability exists in the web routing layer.