Critical severity9.8NVD Advisory· Published Jun 12, 2026· Updated Aug 7, 2026
CVE-2026-50628
CVE-2026-50628
Description
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this
security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.cxf:cxf-rt-rs-security-oauth2Maven | >= 4.2.0, < 4.2.2 | 4.2.2 |
org.apache.cxf:cxf-rt-rs-security-oauth2Maven | < 4.1.7 | 4.1.7 |
Affected products
2- Range: before 4.2.2, 4.1.7, 3.6.12
Patches
Vulnerability mechanics
References
8- www.openwall.com/lists/oss-security/2026/06/11/5nvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-g5v7-jchf-7jrrghsaADVISORY
- lists.apache.org/thread/vb3ho8lf228gh90m1fpnohf2008xrdxknvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-50628ghsaADVISORY
- access.redhat.com/errata/RHSA-2026:37390nvdWEB
- access.redhat.com/security/cve/CVE-2026-50628nvdWEB
- bugzilla.redhat.com/show_bug.cginvdWEB
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50628.jsonnvdWEB
News mentions
0No linked articles in our index yet.