# Spring ApplicationContext Hierarchy and a High CVE in Axelix

Source: [foojay.io - Friends Of OpenJDK](https://foojay.io/today/spring-context-hierarchy/) · 2026-11-12 · Languages
Page: https://themorning.dev/story/spring-applicationcontext-hierarchy-and-a-high-cve-in-axelix-f18e15126f6f9d3f
Kind: security · Impact: high

## In brief

- Axelix has a high-severity CVE involving a JWT bypass.
- The bypass arose when Actuator ran on a separate management port, due to Spring's ApplicationContext hierarchy.
- The source explains how the hierarchy caused the flaw.

## Why it matters

Teams running Axelix, or Spring applications with Actuator on a separate management port, may be exposed to a JWT authentication bypass.

## Coverage

- [Spring ApplicationContext Hierarchy and a High CVE in Axelix](https://foojay.io/today/spring-context-hierarchy/) — foojay.io - Friends Of OpenJDK, 2026-11-12

Tags: spring, security, jwt, actuator, axelix, vulnerability

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev