~ / search / GHSA-g5v7-jchf-7jrr

GHSA-g5v7-jchf-7jrr

Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-50628

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 >= 4.2.0, < 4.2.2 4.2.2
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 < 4.1.7 4.1.7

Details

As written in the advisory (Markdown source, shown as plain text).

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

References

External links from the advisory. They lead to third-party sites.