CVE-2026-79650

Apache CXF’s OpenID Connect relying-party component can redirect a user to an attacker-controlled URL after successful authentication. Attacker-controlled state parameters are preserved and later used as redirect targets without checking that the final decoded URI belongs to the relying party’s origin; both directly encoded and double-encoded external URLs can trigger the issue depending on the validation path. An attacker can abuse this open redirect (CWE-601) to send authenticated users to a malicious site for phishing or token theft. Any deployment using the vulnerable OIDC RP component is affected; the vendor fixes are 4.2.4, 4.1.9, and 3.6.13. There is no known public proof of concept, CVSS is not yet scored, and the issue is not on the CISA KEV list.

What to do: Upgrade Apache CXF to 4.2.4, 4.1.9, or 3.6.13 on the release line you use. Until then, treat post-authentication redirects from the OIDC relying party as untrusted and confirm the final decoded target stays on the RP origin, especially where login is reachable by untrusted users.