Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.7%
probabilidade de exploração
0.7%top 50% das CVEs
exploração observada
nãonenhuma fonte reporta
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this
security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Apache Software Foundation · Apache CXFReferências
https://access.redhat.com/errata/RHSA-2026:37390https://access.redhat.com/security/cve/CVE-2026-50628https://bugzilla.redhat.com/show_bug.cgi?id=2488302https://lists.apache.org/thread/vb3ho8lf228gh90m1fpnohf2008xrdxkhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50628.jsonhttp://www.openwall.com/lists/oss-security/2026/06/11/5