CVE-2026-18918

Name of the Vulnerable Software and Affected Versions Eclipse Lyo versions 2.0.0 through 7.0.0

Description OAuth server authorization checks can be bypassed when the server supports 2-legged authentication. Applications utilizing the AbstractAdapterCredentialsFilter for authorization filters are affected. An attacker can create a provisional trusted client and use it as a trusted client immediately, bypassing the requirement for administrator approval to clear the provisional status. The 3-legged authentication path, which requires user interaction, is not affected.

Recommendations Update Eclipse Lyo to a version later than 7.0.0. As a temporary mitigation, restrict the use of the AbstractAdapterCredentialsFilter for authorization filters.