CVE-2026-50628

Critical · CVSS 9.8

Apache (OAuthRequestFilter) — Improper Input Validation / Inverted Security Check (CWE-20) - IP-based OAuth request filtering logic error

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-20

Description

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Search profile — drives PoC discovery

Symbols OAuthRequestFilterbound IP addressinverse security checkIP address allowOAuth filter logic

Keywords CVE-2026-50628OAuthRequestFilterIP address bypassOAuth logic errorApache OAuth inverted checksecurity filter bypassbound IPCWE-20 OAuth

Versions: < 4.1.7, < 4.2.2 (fixed in 4.1.7 and 4.2.2)

References

Status: enriched · ingested 2026-06-16T00:00:58.000Z · profiled 2026-06-16T18:20:23.035Z