by Kastro
Paper/Archive/CVE-2026-50628

CVE-2026-50628

Apache Software Foundation Apache CXF — Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.3.533 × 2010.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Affected

ProductAffectedFixed inSource
Apache CXF4.2.0 – < 4.2.24.2.2CNA
Apache CXF4.0.0 – < 4.1.74.1.7CNA
Apache CXF< 3.6.123.6.12CNA
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16see advisorysecurity-oauth2redhat-SADP
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16see advisoryoauth2-samlredhat-SADP
Red Hat Fuse 7see advisory–redhat-SADP
Red Hat Fuse 7see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform Expansion Packsee advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform Expansion Packsee advisory–redhat-SADP
Red Hat JBoss Web Server 5see advisory–redhat-SADP
Red Hat JBoss Web Server 5see advisory–redhat-SADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat-SADP (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/vb3ho8lf228gh90m1fpnohf2008xrdxkrefopenwall.com/lists/oss-security/2026/06/11/5refaccess.redhat.com/security/cve/CVE-2026-50628refbugzilla.redhat.com/show_bug.cgi?id=2488302refsecurity.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50628.jsonadvisoryaccess.redhat.com/errata/RHSA-2026:37390