CVE-2026-50628

—

CVSS 3.1

9.8 critical

EPSS

<1%p50

Published

Jun 12, 2026 (Jun 12, 2026)

Modified

Aug 7, 2026

Description

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Vendors: apache
Products: cxf
Weakness: CWE-20, CWE-358
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.