CVE-2026-79650 Apache CXF: OIDC RP Open Redirect
Attackers can redirect users to malicious sites after OIDC authentication due to improper validation of state parameters in Apache CXF.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-79650?
CVE-2026-79650 is a medium-severity vulnerability in Apache Cxf, published on 9 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the RP’s origin. Both directly encoded and double-encoded external URLs can trigger the issue, depending on which validation path is used. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Weakness: CWE-601
Which versions are affected by CVE-2026-79650?
It affects 1 product.
Products include Apache Cxf.
How do I fix CVE-2026-79650?
Upgrade to a fixed version.
Is CVE-2026-79650 being exploited?
There is no known exploitation of CVE-2026-79650 in the wild and no public exploit code.
Other vulnerabilities in Apache Cxf
- CVE-2012-2379 XML Signature/Encryption Not Validated in Apache CXF
- CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
- CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
- CVE-2026-50628 Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
- CVE-2025-48913 Apache CXF: Untrusted JMS configuration can lead to RCE
Sources
Also known as CLEANSTART-2026-NU72264, GHSA-75qj-7h27-jm2v.