CVE-2026-79650

Overview

Apache CXF is an open-source services framework, maintained by the Apache Software Foundation, for building and consuming web services in Java. It implements the JAX-WS and JAX-RS APIs and supports SOAP, the WS-* standards, RESTful HTTP, and OAuth 2.0 over transports such as HTTP and JMS. Its modules are published as Maven artifacts under org.apache.cxf.

An open redirect vulnerability (CVE-2026-79650) has been identified in the OpenID Connect (OIDC) relying-party component of Apache CXF, which allows attackers to redirect users to an attacker-controlled URL after a successful sign-in. Both directly encoded and double-encoded external URLs can trigger the redirect, which can be used for phishing and credential theft.

Per OWASP: Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

This issue affects multiple versions of Apache CXF.

Details

Module Info

• Product: Apache CXF
• Affected packages: org.apache.cxf:cxf-rt-rs-security-sso-oidc
• Affected versions: <3.6.13, >=4.0.0 <4.1.9, >=4.2.0 <4.2.4
• GitHub repository: https://github.com/apache/cxf
• Published packages: https://central.sonatype.com/artifact/org.apache.cxf/cxf-rt-rs-security-sso-oidc
• Package manager: Maven
• Fixed in:
  • OSS Apache CXF 3.6.13, 4.1.9, 4.2.4
  • NES for Apache CXF v3.4.13, v3.5.14

Vulnerability Info

This High-severity vulnerability is found in the org.apache.cxf:cxf-rt-rs-security-sso-oidc package in multiple versions of Apache CXF.

The OIDC relying-party filter, OidcRpAuthenticationFilter, copies the query parameters and form parameters of the incoming request into the state of the client token context. After sign-in, OidcRpAuthenticationService.completeAuthentication reads the state value from that context, URL-decodes it, and returns it to the browser as a 303 See Other redirect:

URI redirectUri = null;
MultivaluedMap<String, String> state = oidcContext.getState();
String location = state != null ? state.getFirst("state") : null;
if (location == null && defaultLocation != null) {
    String basePath = (String)mc.get("http.base.path");
    redirectUri = UriBuilder.fromUri(basePath).path(defaultLocation).build();
} else if (location != null) {
    redirectUri = URI.create(UrlUtils.urlDecode(location));
}
if (redirectUri != null) {
    return Response.seeOther(redirectUri).build();
}

Nothing checks that the decoded URI is relative or shares the scheme and authority of the relying party. An attacker who gets a victim to follow a link carrying a state value that encodes an external URL (directly or double-encoded) causes the application to send the victim, now signed in, to the attacker's site, which can then pose as the application to harvest credentials or other data.

Mitigation

Only recent versions of Apache CXF are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Apache CXF release line (3.6.x or later) that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Guanping Zhang (finder)