Homepage

Authorization Bypass Through User-Controlled Key The advisory has been revoked - it doesn't affect any version of package pki-resteasy  (opens in a new tab)

Threat Intelligence

EPSS
0.21% (12th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS9-PKIRESTEASY-17753405
  • published1 Jul 2026
  • disclosed23 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 23 Jun 2026

NewCVE-2026-54518  (opens in a new tab)
CWE-639  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream pki-resteasy package and not the pki-resteasy package as distributed by Centos.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active. This vulnerability is fixed in 2.21.4 and 3.1.4.