{"id":"CVE-2026-50628","aliases":["EUVD-2026-36396","GHSA-542g-m3fx-q86f","GHSA-83r6-96m8-r52p","GHSA-9mrv-8pvf-hf4m","GHSA-f8p7-h97q-7vx7","GHSA-g5v7-jchf-7jrr","GHSA-xf62-wr5p-5p95","RHLW-2026-fd244c7ea4e4e9e4"],"status":"published","title":"Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control","description":"A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this\n\nsecurity feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00735,"percentile":0.54879,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-358"],"published":"2026-06-12T08:56:28Z","modified":"2026-11-05T16:18:06Z","fixes":[{"ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","fixed_in":["4.2.2","4.1.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.2.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.7"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.2.2"}]}],"versions":["4.2.0","4.2.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.7"}]}],"versions":["2.6.0","2.6.1","2.6.10","2.6.11","2.6.12","2.6.13","2.6.14","2.6.15","2.6.16","2.6.17","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.16","2.7.17","2.7.18","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","3.0.0","3.0.0-milestone1","3.0.0-milestone2","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.3.0","3.3.1","3.3.10","3.3.11","3.3.12","3.3.13","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.3.8","3.3.9","3.4.0","3.4.1","3.4.10","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9","3.5.0","3.5.1","3.5.10","3.5.11","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","3.6.0","3.6.1","3.6.10","3.6.11","3.6.12","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7","3.6.8","3.6.9","4.0.0","4.0.1","4.0.10","4.0.11","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.1.0","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9.rhlw-00003"}]}],"versions":["2.6.0","2.6.1","2.6.10","2.6.11","2.6.12","2.6.13","2.6.14","2.6.15","2.6.16","2.6.17","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.16","2.7.17","2.7.18","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","3.0.0","3.0.0-milestone1","3.0.0-milestone2","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.3.0","3.3.1","3.3.10","3.3.11","3.3.12","3.3.13","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.3.8","3.3.9","3.4.0","3.4.1","3.4.10","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9","3.5.0","3.5.1","3.5.10","3.5.11","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7","3.6.8","3.6.9"],"bundled":11}],"products":[{"vendor":"apache","product":"cxf"},{"vendor":"apache software foundation","product":"apache cxf"},{"vendor":"red hat","product":"red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat jboss web server 5"},{"vendor":"redhat","product":"build_of_apache_camel"},{"vendor":"redhat","product":"fuse"},{"vendor":"redhat","product":"jboss_web_server"}],"references":[{"url":"https://lists.apache.org/thread/vb3ho8lf228gh90m1fpnohf2008xrdxk","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/06/11/5","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50628","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488302","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50628.json","tags":["x_sadp-csaf-vex","Third Party Advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37390","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50628","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g5v7-jchf-7jrr","tags":["advisory"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50628.json","tags":["advisory"]},{"url":"https://github.com/apache/cxf","tags":["package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50623.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/ydzj8m5mqmjy13xgyj9mkk9hfff63qq7","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50623","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-542g-m3fx-q86f","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50627.json","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50627","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50627.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/0jfzz9q992957b99tw7hodcqjfyxwb1m","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50627","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9mrv-8pvf-hf4m","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50629.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/xw95po30p8th58ms1no6b0f2375cql00","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50629","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f8p7-h97q-7vx7","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50630.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/bt7vnjzzkpd6vdhkxv103poor1jy5trm","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50630","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xf62-wr5p-5p95","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50631.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/s83t3x4r626o9h8rt0ryr1w7w53l1vv8","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50631","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-83r6-96m8-r52p","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57818.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/7q08mz8bcbosp25wok7gr537zlp15mfz","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57818","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61466.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/2l1r16g79tpxd7fzrzr2q9oscwrjgljs","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61466","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63687.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/drcq4chmt0btx86f17o47j17r378hzpw","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63687","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68079.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/6m06gdqz4rxhy9g90qz9lyqx2gqmf13o","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68079","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68481.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/88c0h10yjb2b8201o1km3st71fs2zw2b","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68481","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-50628","title":"Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control","description":"A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this\n\nsecurity feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.","status":"published","published":"2026-06-12T08:56:28.526Z","modified":"2026-08-10T12:05:47.24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-20","CWE-358"],"updated_at":"2026-11-02T14:20:08.734143Z"}],"euvd":[{"id":"EUVD-2026-36396","description":"A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this\n\nsecurity feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.","status":"published","published":"2026-06-12T08:56:28Z","modified":"2026-08-10T12:05:47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:02:05.732685Z"}],"ghsa":[{"id":"GHSA-g5v7-jchf-7jrr","title":"Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control","description":"A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this\n\nsecurity feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.","status":"published","published":"2026-06-12T12:31:33Z","modified":"2026-08-20T18:31:57Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-358"],"updated_at":"2026-11-02T14:41:03.602876Z"}],"nvd":[{"id":"CVE-2026-50628","description":"A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this\n\nsecurity feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.","status":"published","published":"2026-06-12T10:16:22.71Z","modified":"2026-11-05T16:18:06.117Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-20","CWE-358"],"updated_at":"2026-11-05T19:55:55.702046Z"}],"osv":[{"id":"CVE-2026-50628","title":"Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control","description":"A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this\n\nsecurity feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.","status":"published","published":"2026-06-12T08:56:28.526Z","modified":"2026-11-07T02:48:30.405529011Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-07T03:08:06.729372Z"},{"id":"GHSA-g5v7-jchf-7jrr","title":"Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control","description":"A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this\n\nsecurity feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.","status":"published","published":"2026-06-12T12:31:33Z","modified":"2026-08-20T18:48:08.578655Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-358"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"RHLW-2026-fd244c7ea4e4e9e4","title":"Lightwell Security Advisory: cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003","description":"Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003 with backported fixes for CVE-2026-50623, CVE-2026-50627, CVE-2026-50628, CVE-2026-50629, CVE-2026-50630, CVE-2026-50631, CVE-2026-57818, CVE-2026-61466, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481.\n\nCVE-2026-50623: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService\n\nCVE-2026-50627: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator\n\nCVE-2026-50628: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control\n\nCVE-2026-50629: Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier\n\nCVE-2026-50630: Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection\n\nCVE-2026-50631: Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing\n\nCVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider\n\nCVE-2026-61466: Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation\n\nCVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters\n\nCVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay\n\nCVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider\n\nThis patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9 from Maven Central.","status":"published","published":"2026-10-13T21:10:18Z","modified":"2026-10-27T04:13:03.043123153Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:59.135214Z"}]}}