CVE-2026-18918

CVE-2026-18918 is an authorization-check bypass (CWE-863, CVSS 4.0 score 9.1 critical) in the Eclipse Lyo OSLC SDK, versions 2.0.0 through 7.0.0, affecting OAuth servers that support 2-legged authentication and applications whose authorization filters are built on Lyo's AbstractAdapterCredentialsFilter. An attacker can create a provisional trusted client, which is a normally valid use-case, and the vulnerable filter then accepts it as a fully trusted client immediately without the administrator approval normally required to clear its provisional status. This grants the attacker authorized access to the adapter's protected resources over the network without user interaction or privileges, with high confidentiality and integrity impact but no availability impact per the CVSS vector (AV:N/AC:L/AT:P/VC:H/VI:H). Only servers enabling 2-legged OAuth are affected; the 3-legged path that requires user interaction is not vulnerable and correctly rejects provisional clients. Exploitation is not currently observed: there is no public proof of concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.4% probability of exploitation in the next 30 days.

What to do: Upgrade to a patched Eclipse Lyo release newer than 7.0.0 as soon as one is published (no fixed version number is stated in the available data). As an interim mitigation, disable 2-legged OAuth support if it is not required, or tighten client registration so provisional clients cannot be used until an administrator has cleared them. If your applications implement custom authorization filters based on AbstractAdapterCredentialsFilter, add an explicit check that a client's provisional status has been administratively cleared before granting access.