← CVE Intelligence

CVE-2026-8590

Spotfire OAuth2 PKCE Bypass for public clients PUBLISHED

Description (CNA)

Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Consumers (Spotfire Server modules), Spotfire Spotfire on Kubernetes (Spotfire Server modules). This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire Enterprise with External Consumers: through 14.0.12, through 14.5.0, through 14.6.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire on Kubernetes: through 4.2.0, 5.0.X, 6.0.X.

Affected (CNA)

Vendor / productVersions
Spotfire / Spotfire Enterpriseaffected 0 through 14.0.12; affected 0 through 14.4.2; affected 0 through 14.5.0; affected 0 through 14.6.1; affected 0 through 14.6.2; affected 0 through 14.7.0; affected 0 through 14.8.0
Spotfire / Spotfire Enterprise with External Consumersaffected 0 through 14.0.12; affected 0 through 14.5.0; affected 0 through 14.6.0; affected 0 through 14.6.1; affected 0 through 14.6.2; affected 0 through 14.7.0; affected 0 through 14.8.0
Spotfire / Spotfire on Kubernetesaffected 0 through 4.2.0; affected 5.0.x; affected 6.0.x

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.