CVE-2026-79650

MediumCVSS 6.1/10Last modified Oct 20, 2026

Description

Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the RP’s origin. Both directly encoded and double-encoded external URLs can trigger the issue, depending on which validation path is used. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Oct 9, 2026
Last modified: Oct 20, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-796517.5A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentic CVE-2026-796525.9A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. T CVE-2026-796536.0In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key ena CVE-2026-796544.3A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specifi CVE-2026-796557.8A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creati CVE-2026-796579.8NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces CVE-2026-796587.5Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on ever CVE-2026-796597.7Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP reque CVE-2026-79663.1Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compro CVE-2026-796605.3Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on th CVE-2026-796616.5Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthe CVE-2026-796628.0Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect (internal/service/auth/auth.go)