GitHub Advisoryadvisory · Maven

GHSA-g5v7-jchf-7jrr Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control

CRITICAL Published 2026-06-12 Modified 2026-08-20 Official page ↗
Aliases
CVE-2026-50628
Ecosystem
Maven
Packages
org.apache.cxf:cxf-rt-rs-security-oauth2
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-358
Reviewed
2026-08-20

Affected packages

• Maven org.apache.cxf:cxf-rt-rs-security-oauth2: >= 4.2.0, < 4.2.2 → fixed in 4.2.2 • Maven org.apache.cxf:cxf-rt-rs-security-oauth2: < 4.1.7 → fixed in 4.1.7

Description

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2026-50628 A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-358 Improperly Implemented Security Check for Standard weakness

References