CVE-2026-50628

[Каталог CVE]

A flaw was found in the OAuthRequestFilter component of cxf. A logic error in this filter inadvertently creates an inverse security check when enabled. This issue causes legitimate requests from a bound IP address to be rejected, while requests from any other IP address are blindly allowed. This could lead to unauthorized access to resources. cxf: org.apache.cxf/cxf-rt-rs-security-oauth2: cxf: Unauthorized access due to logic error in OAuthRequestFilter The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it requires the attacker to first obtain a valid OAuth2 access token through a separate attack vector (such as token leakage, network interception, or log exposure) before exploitation is possible. Successful exploitation allows an attacker to replay a stolen token from any IP address, bypassing the sender-constrained token binding security control and gaining unauthorized access to protected resources as the legitimate token holder. The vulnerability's root cause is an inverted logic check in the IP binding validation of the cxf-rt-rs-security-oauth2 module, which permits token usage from non-matching IP addresses instead of rejecting it. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Критичність

Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

Jun 11, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.71% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "cxf",
      "fixed_version": "4.1.7",
      "applicability_unknown": true
    },
    {
      "name": "cxf",
      "fixed_version": "4.2.2",
      "applicability_unknown": true
    },
    {
      "name": "org.apache.cxf:cxf-rt-rs-security-oauth2",
      "ecosystem": "maven",
      "provider_url": "https://github.com/advisories/GHSA-g5v7-jchf-7jrr",
      "fixed_version": "4.1.7",
      "provider_source": "github",
      "provider_record_id": "GHSA-G5V7-JCHF-7JRR",
      "provider_updated_at": "2026-08-20T18:31:57Z"
    },
    {
      "name": "cxf",
      "ranges": [
        {
          "fixed": "4.2.2",
          "introduced": "4.2.0",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50628",
      "fixed_version": "4.2.2",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-50628",
      "provider_updated_at": "2026-10-26T11:10:00.157"
    }
  ]
}