Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the run method of the ProviderSpecificBootstrapImpl class in Validation.java, which passes a caller influenced action to the single argument form of AccessController.doPrivileged, dropping the calling thread's restricted ProtectionDomain from the access control stack. Code running in a restricted domain can execute an arbitrary class's no-arg constructor under the library's broader permissions by passing any Class object to Validation.byProvider through a raw or unchecked cast, since the generic bound is erased and NewProviderInstance.run reaches clazz.newInstance before the cast to ValidationProvider is attempted. Exploitation requires a JVM running with a SecurityManager, a code source for the library granted more permissions than the caller, the ability to run code in process, and a reachable class in a privileged domain whose public no-arg constructor performs a security checked side effect, and the gadget's own ProtectionDomain stays on the stack so a self defined class yields nothing.
Note: Only deployments on JDK releases before 24 are affected. The run helper elevates privilege only when System.getSecurityManager() returns non-null, and JEP 486 permanently disabled the Security Manager in JDK 24.
Remediation
Upgrade jakarta.validation:jakarta.validation-api to version 4.0.0-M1 or higher.