Skip to content
OpenAdvisories
High · 8.7 CVE-2026-8590 EUVD-2026-43678GHSA-q55h-7282-gq6q

Spotfire OAuth2 PKCE Bypass for public clients

Published Jul 14, 2026 · Updated Jul 14, 2026 · Assigned by Spotfire

Description

Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Consumers (Spotfire Server modules), Spotfire Spotfire on Kubernetes (Spotfire Server modules).

This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire Enterprise with External Consumers: through 14.0.12, through 14.5.0, through 14.6.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire on Kubernetes: through 4.2.0, 5.0.X, 6.0.X.

Affected products

VendorProductAffectedFixed
Spotfire Spotfire Enterprise ≤ 14.0.12, ≤ 14.4.2, ≤ 14.5.0, ≤ 14.6.1, ≤ 14.6.2, ≤ 14.7.0, ≤ 14.8.0 —
Spotfire Spotfire Enterprise with External Consumers ≤ 14.0.12, ≤ 14.5.0, ≤ 14.6.0, ≤ 14.6.1, ≤ 14.6.2, ≤ 14.7.0, ≤ 14.8.0 —
Spotfire Spotfire on Kubernetes ≤ 4.2.0, 5.0.x, 6.0.x —

Advisories 1

References