CVE-2026-79650

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13

Description The OIDC relying-party component allows the redirection of users to an attacker-controlled URL following successful authentication. This occurs because the system preserves attacker-controlled state parameters and uses them as redirect targets without verifying if the final decoded URI belongs to the relying party origin. The issue can be triggered using either directly encoded or double-encoded external URLs, depending on the validation path utilized.

Recommendations Update to version 4.2.4. Update to version 4.1.9. Update to version 3.6.13.