CVE-2026-79650: Apache CXF: OIDC RP Open Redirect

As cited

Copy frozen at 2026-10-09 13:24 UTC (site build).

vulnerabilities

CVE-2026-79650: Apache CXF: OIDC RP Open Redirect

Apache CXF versions before 3.6.13, 4.1.9, and 4.2.4 contain an open redirect vulnerability in the OpenID Connect relying-party component that could redirect authenticated users to attacker-controlled URLs. The flaw allows attackers to potentially harvest credentials or perform phishing after exploiting the authentication flow.

Why it matters: Organizations using Apache CXF for OIDC authentication must patch immediately, as successful exploitation could redirect users post-authentication to malicious sites, undermining the security of the authentication mechanism itself.

Source published

2026-10-09 10:17 UTC

First seen by Cybersecurity Tracker

2026-10-09 11:33 UTC