Vulnerability Description
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Cxf | < 4.1.7 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/vb3ho8lf228gh90m1fpnohf2008xrdxkVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/06/11/5Mailing ListThird Party Advisory
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/security/cve/CVE-2026-50628
- https://bugzilla.redhat.com/show_bug.cgi?id=2488302
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50628.json
FAQ
What is CVE-2026-50628?
CVE-2026-50628 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadve...
How severe is CVE-2026-50628?
CVE-2026-50628 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-50628?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Cxf.