PUBLISHED
2026-06-12 10:16
MODIFIED
2026-06-12 10:16
EPSS (Prob. Exploit)
0.71%
Top 46.6%
> DESCRIPTION
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this
security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-20: Improper Input Validation - The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly.
> RED HAT SECURITY ADVISORIES
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.1.P1 for Spring Boot release.
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot patch release and security update is now available.
Red Hat Product Security has rated this update as having a security impact of
Important. A...
> GITHUB SECURITY ADVISORY
GHSA-g5v7-jchf-7jrr
CRITICAL
Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control
AFFECTED PACKAGES:
MAVEN / org.apache.cxf:cxf-rt-rs-security-oauth2
< 4.1.7
Fixed in: 4.1.7
MAVEN / org.apache.cxf:cxf-rt-rs-security-oauth2
>= 4.2.0, < 4.2.2
Fixed in: 4.2.2
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
AFFECTED PACKAGES:
Unknown / Unknown
48 versions affected
ALIASES:
GHSA-g5v7-jchf-7jrr
> HISTORIQUE DES MODIFICATIONS
Première apparition
12/06/2026 10:16
Source: NVD
📊
ENRICHISSEMENT
01/07/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-20: Improper Input Validation - The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process...
Total des modifications: 1
Dernière mise à jour: 4 months ago