CVE-2026-18918: OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default
In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided AbstractAdapterCredentialsFilter, are vulnerable. An attacked can create a provisional trusted client (valid use-case) but then it can be used as a trusted client immediately without requiring the administrator approval to clear the provisional status. The 3-legged path requiring user interaction is not vulnerable and rejects provisional clients.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when the OAuth server supports 2-legged authentication and the application relies on Lyo-provided AbstractAdapterCredentialsFilter for authorization filtering. Eclipse Lyo versions 2.0.0 through 7.0.0 are identified as affected.
What does an attacker need to exploit the bypass?
An attacker needs to create a provisional trusted client through the unauthenticated provisional-consumer registration flow. That client can then be used immediately as trusted without administrator approval clearing its provisional status.
Does the 3-legged OAuth flow mitigate the issue?
Yes. The 3-legged path that requires user interaction is not vulnerable and rejects provisional clients.