Back to Database
Status published
High
CVE-2025-14340
Admin Account Takeover via malicious URL payload
Vulnerability Description
Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-14340
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Camilo G. AkA Dédalo [https://x.com/SeguridadBlanca] (DeepSecurity Perú - [https://www.deepsecurity.pe])
More from Payara Platform
View All →CVE-2025-1534
Cross-site Scripting (Stored)
Medium
6.8
CVE-2024-8215
Payload Injection Attack via Management REST interface
High
8.7
CVE-2024-8097
Sensitive information exposure when the org.glassfish.admingui LOGGER is set to FINEST level
Medium
6.7
CVE-2024-7312
REST Interface Link Redirection via Host parameter
High
7
CVE-2024-45687
HTTP Server incorrectly accepting disallowed characters within header values
Low
2.4
Affected Vendor
Payara Platform
View all reports →Affected Software
Payara Server
Vulnerable Versions:
4.1.153.1, 5.20.0, 6.0.0, 7.2024.1.Alpha1, 6.2022.1, 5.2020.2, 5.181, 4.1.2.191.54, 5.83.0, 6.34.0, 7.2026.1
Timeline
Official Publish:
February 18th, 2026
Last Modified:
February 19th, 2026
Added to House:
July 22nd, 2026