CVE-2026-50628
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this
security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this
security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Record
CVE-2026-50628- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-20, CWE-358
- Updated
- 2026-11-05
CVE List
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this
security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Record
CVE-2026-50628- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-20, CWE-358
- Updated
- 2026-11-02
EUVDEUVD-2026-36396
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this
security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Record
EUVD-2026-36396- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g5v7-jchf-7jrr
Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this
security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
- Record
GHSA-g5v7-jchf-7jrr- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-358
- Updated
- 2026-11-02
OSV
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this
security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Record
CVE-2026-50628- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-07
OSVGHSA-g5v7-jchf-7jrr
Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this
security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
- Record
GHSA-g5v7-jchf-7jrr- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-358
- Updated
- 2026-11-02
OSVRHLW-2026-fd244c7ea4e4e9e4
Lightwell Security Advisory: cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003
Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003 with backported fixes for CVE-2026-50623, CVE-2026-50627, CVE-2026-50628, CVE-2026-50629, CVE-2026-50630, CVE-2026-50631, CVE-2026-57818, CVE-2026-61466, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481.
CVE-2026-50623: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
CVE-2026-50627: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator
CVE-2026-50628: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
CVE-2026-50629: Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier
CVE-2026-50630: Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection
CVE-2026-50631: Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing
CVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider
CVE-2026-61466: Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation
CVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters
CVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
CVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider
This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9 from Maven Central.
- Record
RHLW-2026-fd244c7ea4e4e9e4- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-rt-rs-security-oauth2Maven |
4.2.0 up to 4.2.2 | 4.2.2 |
org.apache.cxf:cxf-rt-rs-security-oauth2Maven |
before 4.1.7 | 4.1.7 |
org.apache.cxf:cxf-rt-rs-security-oauth2Maven |
4.2.0 up to 4.2.2, plus listed versions 4.2.1 |
4.2.2 |
org.apache.cxf:cxf-rt-rs-security-oauth2Maven |
before 4.1.7, plus listed versions 2.6.02.6.12.6.102.6.112.6.12 Show 45 moreShow less2.6.132.6.142.6.152.6.162.6.172.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.92.7.02.7.12.7.102.7.112.7.122.7.132.7.142.7.152.7.162.7.172.7.182.7.22.7.32.7.42.7.52.7.62.7.72.7.82.7.93.0.03.0.0-milestone13.0.0-milestone23.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.163.0.23.0.3 |
4.1.7 |
org.apache.cxf:cxf-rt-rs-security-oauth2Red Hat Lightwell:Maven From an advisory covering 11 CVEs |
before 3.6.9.rhlw-00003, plus listed versions 2.6.02.6.12.6.102.6.112.6.12 Show 45 moreShow less2.6.132.6.142.6.152.6.162.6.172.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.92.7.02.7.12.7.102.7.112.7.122.7.132.7.142.7.152.7.162.7.172.7.182.7.22.7.32.7.42.7.52.7.62.7.72.7.82.7.93.0.03.0.0-milestone13.0.0-milestone23.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.163.0.23.0.3 |
3.6.9.rhlw-00003 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts, products, references | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-50628 is a critical vulnerability (CVSS 9.8) in Apache Cxf, published June 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in org.apache.cxf:cxf-rt-rs-security-oauth2 4.2.2.
References
lists.apache.org/thread/vb3ho8lf228gh90m1fpnohf2008xrdxk
openwall.com/lists/oss-security/2026/06/11/5
access.redhat.com/security/cve/CVE-2026-50628
bugzilla.redhat.com/show_bug.cgi?id=2488302
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50628.json
Show 42 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-50628
github.com/advisories/GHSA-g5v7-jchf-7jrr
repo.maven.apache.org/maven2
Left out here: 196 versions. The JSON record has them.