OpenID Connect Vulnerability in Apache CXF's Relying-Party Component

CVE-2026-79650

What is CVE-2026-79650?

A vulnerability in Apache CXF's OpenID Connect relying-party component permits attackers to redirect users to malicious URLs after successful authentication. This issue arises from the preservation of attacker-controlled state parameters, which can be used without proper validation of the final decoded URI against the Relying Party's origin. Both directly encoded and double-encoded URLs can exploit this flaw, potentially leading users to unsafe locations. It is advised for users to upgrade to Apache CXF versions 4.2.4, 4.1.9, or 3.6.13 to mitigate this vulnerability.

References