CVE-2026-85511

Red Hat statement

Red Hat Product Security has rated this issue as having a Low impact. This flaw is limited to improper parameter formatting when the application server forwards a token to an external Identity Provider (IdP) for verification. Under specific conditions, a malformed token can inject additional data into that outgoing verification request. The application server relies on the external IdP to decide whether a token is valid, and standard IdPs automatically reject malformed or invalid requests. Additionally, role and access permissions are strictly enforced inside the application server after the identity check is completed. Because an attacker cannot force an authentication bypass using a standard IdP setup, the overall security risk is minimal and the real-world impact remains low.