CVE-2026-79650
Apache Cxf: open redirect
- Risk score
- 42/100
- CVSS
- 6.1 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 9 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the RP’s origin. Both dir…
- Affected
- Apache Cxf before 4.2.4, 4.1.9, 3.6.13
- Fix
- Upgrade Apache Cxf to 4.2.4, 4.1.9 or 3.6.13 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Story map
At a glance
Apache Cxf: Amber, patch this week. The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication pol…
The flaws
- CVE-2026-79650: Open redirect (CVSS 6.1 · EPSS 0%)
- CVE-2026-71575: The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a… (CVSS 9.1 · EPSS 0%)
- CVE-2026-97468: Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens… (CVSS 9.1 · EPSS 0%)
- CVE-2026-107938: In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not… (CVSS 9.1 · EPSS 0%)
The fix
Upgrade Apache Cxf: 4.2.4 · 4.1.9 · 3.6.13 or later on your release line
Who is exposed: Apache Cxf before 4.2.4, 4.1.9, 3.6.13
Where it stands
- No known exploitation
Connects to
- Same weakness: Open redirect (CWE-601). 20 other warnings in 30 days
- Same product: Earlier Apache Cxf warnings. 7 in the last 90 days
Why it is Yellow
- CVSS 6.1 medium
References
Original description
Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the RP’s origin. Both directly encoded and double-encoded external URLs can trigger the issue, depending on which validation path is used. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Last activity 9 Oct 2026. Patch Forecast updates every hour.