Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-8590

Spotfire OAuth2 PKCE Bypass for public clients

Description

Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Consumers (Spotfire Server modules), Spotfire Spotfire on Kubernetes (Spotfire Server modules). This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire Enterprise with External Consumers: through 14.0.12, through 14.5.0, through 14.6.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire on Kubernetes: through 4.2.0, 5.0.X, 6.0.X.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spotfire Spotfire Enterprise

Default version status: affected

  • 0 to ≤ 14.0.12affected
  • 0 to ≤ 14.4.2affected
  • 0 to ≤ 14.5.0affected
  • 0 to ≤ 14.6.1affected
  • 0 to ≤ 14.6.2affected
  • 0 to ≤ 14.7.0affected
  • 0 to ≤ 14.8.0affected

Spotfire Spotfire Enterprise with External Consumers

Default version status: affected

  • 0 to ≤ 14.0.12affected
  • 0 to ≤ 14.5.0affected
  • 0 to ≤ 14.6.0affected
  • 0 to ≤ 14.6.1affected
  • 0 to ≤ 14.6.2affected
  • 0 to ≤ 14.7.0affected
  • 0 to ≤ 14.8.0affected

Spotfire Spotfire on Kubernetes

Default version status: affected

  • 0 to ≤ 4.2.0affected
  • 5.0.xaffected
  • 6.0.xaffected

References