CVE-2026-8590

Spotfire OAuth2 PKCE Bypass for public clients

High · published July 14, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Consumers (Spotfire Server modules), Spotfire Spotfire on Kubernetes (Spotfire Server modules).

This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire Enterprise with External Consumers: through 14.0.12, through 14.5.0, through 14.6.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire on Kubernetes: through 4.2.0, 5.0.X, 6.0.X.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00428 · 36.0th percentile
Published
2026-07-14T13:49Z
EPSS history
Timeline
  • 14 JUL 13:49Z
    Spotfire OAuth2 PKCE Bypass for public clients
    cvelistv5