CVE-2026-50628: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this
security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Other sources
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this
security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.2.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.6.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50628?
CVE-2026-50628 has a risk rating of 30, indicating a significant security vulnerability.
How do I fix CVE-2026-50628?
To fix CVE-2026-50628, users should upgrade to Apache CXF versions 4.2.2 or 4.1.6.
What type of vulnerability is CVE-2026-50628?
CVE-2026-50628 is a logic error related to Input Validation in OAuthRequestFilter.
What does CVE-2026-50628 affect?
CVE-2026-50628 affects the Apache CXF framework and its OAuth2 implementation.
What security control is defeated by CVE-2026-50628?
CVE-2026-50628 defeats the IP binding check, allowing unauthorized requests from any IP address.