Log in Start free

Vulnerability · Published Jun 12, 2026 · Assigned by apache

CVE-2026-50628Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control

Critical 9.8

In plain English

A critical-severity improper input validation in Apache CXF from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.7%top 45.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.cxf:cxf-rt-rs-security-oauth24.2.2GHSA-g5v7-jchf-7jrr
Mavenorg.apache.cxf:cxf-rt-rs-security-oauth24.1.7GHSA-g5v7-jchf-7jrr

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache CXF 4.2.0 – before 4.2.24.0.0 – before 4.1.70 – before 3.6.12

Weakness: CWE-20, CWE-358 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References