CVE detail
CVE-2026-50628
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 19.5 · diversity 14.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
6 source links · newest first
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50628.jsonsecurity.access.redhat.com
No excerpt available.
Vendor Advisorysecurity.access.redhat.comJun 12, 2026, 10:16 AM - https://bugzilla.redhat.com/show_bug.cgi?id=2488302bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comJun 12, 2026, 10:16 AM - https://access.redhat.com/security/cve/CVE-2026-50628access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 12, 2026, 10:16 AM - https://access.redhat.com/errata/RHSA-2026:37390access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 12, 2026, 10:16 AM - http://www.openwall.com/lists/oss-security/2026/06/11/5www.openwall.com
No excerpt available.
Exploitwww.openwall.comJun 12, 2026, 10:16 AM - https://lists.apache.org/thread/vb3ho8lf228gh90m1fpnohf2008xrdxklists.apache.org
No excerpt available.
Vendor Advisorylists.apache.orgJun 12, 2026, 10:16 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2023-28113CVSS 5.9 · Medium
russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficient, which can lead to…
- CVE-2021-34791CVSS 4.7 · Medium
Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower…
- CVE-2021-34790CVSS 4.7 · Medium
Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower…
- CVE-2021-31375CVSS 7.2 · High
An Improper Input Validation vulnerability in routing process daemon (RPD) of Juniper Networks Junos OS devices configured with BGP origin validation using Resource Public Key Inf…
- CVE-2017-15105CVSS 5.3 · Medium
A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence…
- CVE-2026-50633CVSS 8.1 · High
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deploym…