Critical severity9.8NVD Advisory· Published Jun 12, 2026· Updated Jun 15, 2026
CVE-2026-50628
CVE-2026-50628
Description
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this
security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2- www.openwall.com/lists/oss-security/2026/06/11/5nvdMailing ListThird Party Advisory
- lists.apache.org/thread/vb3ho8lf228gh90m1fpnohf2008xrdxknvdVendor Advisory
News mentions
0No linked articles in our index yet.