CVE-2025-14340

High

Published: 18/02/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Cross-site scripting in the REST Management Interface in Payara Server allows an attacker to mislead an administrator into changing the admin password via a crafted URL payload.

Risk Assessment

Risk of admin account takeover and full server compromise, potentially leading to unauthorized access to data and services.

Recommendation

Immediately update Payara Server to version 4.1.2.191.54, 5.83.0, 6.34.0, or 7.2026.1 or later, depending on the release line in use.

Other vulnerabilities in Payara Server

CVE-2026-92082Medium
By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection.

Original NVD description (English source)

Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.