CLEANSTART-2026-GH74416: Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication
Security vulnerability affects the wso2am package. Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/wso2amto a version that resolves this vulnerability.Fixed in 4.7.0-r4
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker can act remotely and does not need prior privileges, but user interaction is required. Exploitation occurs in connection with a user completing authentication through the affected OIDC relying-party flow.
Which deployments should be prioritized for review?
Prioritize cleanstart/wso2am deployments that use Apache CXF’s OIDC relying-party component and expose authentication flows to users. The reported impact is redirection of successfully authenticated users to an attacker-controlled URL.