9.8 Critical
CVE-2026-50628
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
Apache Software FoundationApache CXF
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 26 Oct
0.7%probability of exploitation in the next 30 days
Higher than 53% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Coverage No articles yet
No CyberSIXT article names CVE-2026-50628 yet. New articles appear here and in the RSS feed.