CVE-2026-50628
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Debolezza
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Prodotti interessati
- apache cxf
Riferimenti
- https://lists.apache.org/thread/vb3ho8lf228gh90m1fpnohf2008xrdxk
- http://www.openwall.com/lists/oss-security/2026/06/11/5
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/security/cve/CVE-2026-50628
- https://bugzilla.redhat.com/show_bug.cgi?id=2488302
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50628.json
Trova il bug prima di un attaccante.
Accedi con GitHub e avvia il tuo primo audit in meno di un minuto. Il piano gratuito non richiede carta di credito.