CVE-2026-50628CWE-20CWE-358

CVE-2026-50628

Critical · published June 12, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
63.2
In the wild
Unconfirmed
What it is

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this

security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01022 · 63.2th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-358 · Improperly Implemented Security Check for Standard
Published
2026-06-12T14:16Z
Affected products (2)
ProductVersionsFixed in
apache/cxf< 4.1.74.1.7
apache/cxf≥ 4.2.0, < 4.2.24.2.2
References (6)
https://lists.apache.org/thread/vb3ho8lf228gh90m1fpnohf2008xrdxk · [email protected]http://www.openwall.com/lists/oss-security/2026/06/11/5 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2026:37390 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/security/cve/CVE-2026-50628 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2488302 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50628.json · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
EPSS history
Timeline
  • 12 JUN 08:56Z
    Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
    cvelistv5