CVE-2026-79650

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-79650
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79650.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-79650
Published
2026-10-09T10:18:21Z
Modified
2026-10-24T10:52:09Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Apache CXF: OIDC RP Open Redirect
Details

Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the RP’s origin. Both directly encoded and double-encoded external URLs can trigger the issue, depending on which validation path is used. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Database specific 
{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-601"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79650.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "4.2.0"
                        },
                        {
                            "fixed":  "4.2.4"
                        },
                        {
                            "introduced":  "4.0.0"
                        },
                        {
                            "fixed":  "4.1.9"
                        },
                        {
                            "fixed":  "3.6.13"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/cxf

Affected ranges

Type
GIT
Repo
https://github.com/apache/cxf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8999af05d26ef2e63dc4c77a798595e2a53435ad
Introduced
02310e95fe74c0c031f540f3284e4a9bd856ced2
Fixed
043829b193a6ead389864e636a07ddf6bfa2ca8a
Introduced
04ccbfd709eef8f4af53d6237514fbe9db7ea81f
Fixed
5e324f121104cc76af1b8f3ec0d1a20ef9e98c3b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "3.6.13"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.0.0"
                },
                {
                    "fixed":  "4.1.9"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.2.0"
                },
                {
                    "fixed":  "4.2.4"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

cxf-2.*
cxf-2.1
cxf-2.1.2
cxf-2.2
cxf-2.2.1
cxf-2.2.2
cxf-2.3.0
cxf-2.4.0
cxf-2.5.0
cxf-2.5.1
cxf-2.6.0
cxf-2.6.1
cxf-2.7.0
cxf-2.7.1
cxf-2.7.2
cxf-3.*
cxf-3.0.0
cxf-3.0.0-milestone2
cxf-3.1.0
cxf-3.1.1
cxf-3.1.2
cxf-3.1.3
cxf-3.1.4
cxf-3.2.0
cxf-3.2.1
cxf-3.2.2
cxf-3.2.3
cxf-3.2.4
cxf-3.2.5
cxf-3.3.0
cxf-3.3.1
cxf-3.3.2
cxf-3.3.3
cxf-3.4.0
cxf-3.4.1
cxf-3.5.0
cxf-3.6.0
cxf-3.6.1
cxf-3.6.10
cxf-3.6.11
cxf-3.6.12
cxf-3.6.2
cxf-3.6.3
cxf-3.6.4
cxf-3.6.5
cxf-3.6.6
cxf-3.6.7
cxf-3.6.8
cxf-3.6.9
cxf-4.*
cxf-4.0.0
cxf-4.0.1
cxf-4.0.2
cxf-4.0.3
cxf-4.0.4
cxf-4.1.0
cxf-4.1.1
cxf-4.1.2
cxf-4.1.3
cxf-4.1.4
cxf-4.1.5
cxf-4.1.6
cxf-4.1.7
cxf-4.1.8
cxf-4.2.0
cxf-4.2.1
cxf-4.2.2
cxf-4.2.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79650.json"