CVE-2026-79650: Apache CXF: OIDC RP Open Redirect
Apache CXF’s OIDC relying party can redirect authenticated users to an attacker-controlled URL.
Apache disclosed CVE-2026-79650, an important open-redirect flaw in the CXF OIDC relying-party component (cxf-rt-rs-security-sso-oidc). After successful authentication, the component can send users to an attacker-controlled URL. Affected ranges are 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and releases before 3.6.13. The post does not report exploitation.
- Open redirect in the CXF OIDC relying-party module after successful login.
- Rated important; fixed in 4.2.4, 4.1.9, and 3.6.13.
- No in-the-wild exploitation is described.
- CVEs
- CVE-2026-79650
- Vendors
- Apache
- Products
- Apache CXF
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-79650 | Open Redirect in Apache CXF OIDC Relying Party | 6.1 | — |
From the original article
Posted by Colm O hEigeartaigh on Oct 09 Severity: important Affected versions: - Apache CXF (org. apache. cxf:cxf-rt-rs-security-sso-oidc) 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.