Medium
projeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization
Type: advisorySources: OSV
A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java of the component Authentication Flow. Such manipulation of the argument cod/jwt leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-86274
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 13:18 UTC · Revision 1
Source evidence
projeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization
core-osv · Original sourcePublished 7 Sept 2026, 05:15 UTC
A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java of the component Authentication Flow. Such manipulation of the argument cod/jwt leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
osv:CVE-2026-86274
Complete source record
{
"id": "3724b6aa5af3d10cfe4bba024c527aa879b62bc8461807cae95a99852bfbd352",
"url": "https://osv.dev/vulnerability/CVE-2026-86274",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "projeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization",
"summary": "A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java of the component Authentication Flow. Such manipulation of the argument cod/jwt leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
"evidence": "osv:CVE-2026-86274",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-86274",
"aliases": [
"CVE-2026-86274"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/projeto-siga/siga",
"type": "GIT",
"events": [
{
"introduced": "31dede0a5f4fb9a029ae651d5e70d3ff9c4cad3b"
},
{
"last_affected": "aa988ced156155c9e34245488f5f45383ca79928"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "11.0.2.10"
},
{
"last_affected": "11.0.2.10"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "11.0.2.13"
},
{
"last_affected": "11.0.2.13"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "11.1.1"
},
{
"last_affected": "11.1.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "11.0.2.10"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"11.0.2.10",
"11.0.2.13",
"11.1.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86274.json"
}
}
],
"modified": "2026-10-28T02:30:28.952970873Z",
"provider": "osv",
"references": [
"https://github.com/projeto-siga/siga/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86274.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-86274",
"https://vuldb.com/cve/CVE-2026-86274",
"https://vuldb.com/submit/904871",
"https://vuldb.com/vuln/399435",
"https://github.com/projeto-siga/siga/issues/2493",
"https://vuldb.com/vuln/399435/cti"
],
"provider_metadata": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"cna_assigner": "VulDB",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "11.0.2.0"
},
{
"last_affected": "11.0.2.0"
},
{
"introduced": "11.0.2.1"
},
{
"last_affected": "11.0.2.1"
},
{
"introduced": "11.0.2.2"
},
{
"last_affected": "11.0.2.2"
},
{
"introduced": "11.0.2.3"
},
{
"last_affected": "11.0.2.3"
},
{
"introduced": "11.0.2.4"
},
{
"last_affected": "11.0.2.4"
},
{
"introduced": "11.0.2.5"
},
{
"last_affected": "11.0.2.5"
},
{
"introduced": "11.0.2.6"
},
{
"last_affected": "11.0.2.6"
},
{
"introduced": "11.0.2.7"
},
{
"last_affected": "11.0.2.7"
},
{
"introduced": "11.0.2.8"
},
{
"last_affected": "11.0.2.8"
},
{
"introduced": "11.0.2.9"
},
{
"last_affected": "11.0.2.9"
},
{
"introduced": "11.0.2.11"
},
{
"last_affected": "11.0.2.11"
},
{
"introduced": "11.0.2.12"
},
{
"last_affected": "11.0.2.12"
},
{
"introduced": "11.1.0"
},
{
"last_affected": "11.1.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86274.json"
}
},
"related_cves": [
{
"value": "CVE-2026-86274",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 495784,
"published_at": "2026-09-07T05:15:11.895+00:00"
}