Easily exploitable vulnerability within Oracle JDeveloper’s Security Framework component permits an unauthenticated attacker with network access to send requests that bypass normal authentication checks. The flaw requires the attacker to trigger a request that involves user interaction, such as opening a malicious link or interface. If successfully exploited, the attacker could view or download confidential data or obtain full access to all JDeveloper‑accessible information. This weakness corresponds to open redirect (CWE‑601) issues.

The affected vendor is Oracle Corporation; the product is Oracle JDeveloper. Affected variants are versions 12.2.1.4.0 and 14.1.2.0.0. No other variants or earlier releases are listed in the CNA data.

The CVSS v3.1 Base score of 6.5 indicates moderate severity with confidentiality as the primary impact. The vector shows an attack available over the Internet via HTTP, requiring no special privileges but needing user interaction. The EPSS score of <1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, meaning no known active exploits exist. Despite this low exploitation likelihood, the potential for unauthorized data exposure warrants timely mitigation.