The reported vulnerability is a scope bypass flaw in Eclipse Vert.x Web's ChainAuthHandler. Because the handler does not validate authentication scopes for requests that have already been authenticated earlier in the processing pipeline, an attacker carrying a valid token that lacks the required scopes can reach endpoints that are intended to be protected by scope checks. This flaw arises from a logic error in the postAuthentication() method, which skips scope verification for pre‑authenticated users.

Affected by this issue are Eclipse Vert.x Web deployments built with Vert.x releases 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and the 5.2.0 release. Any application using the io.vertx:vertx-web Maven component in these ranges is vulnerable. The flaw is present when ChainAuthHandler is configured together with JWTAuthHandler or OAuth2AuthHandler that enforce scope requirements via withScope() or withScopes().

The reported CVSS score is 8.6, indicating high severity. The EPSS score of <1% indicates a relatively low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no publicly documented exploits are known. The attack is likely to occur via HTTP requests to the application, taking advantage of pre‑authenticated tokens lacking the required scopes. Because the vulnerability can be triggered by network traffic to the application and only requires a valid token, its potential impact remains significant, but the low EPSS suggests the exploitation likelihood is low to moderate in exposed deployments.