CVE-2026-79650 in CXF
Summary
by MITRE • 10/09/2026
Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the RP’s origin. Both directly encoded and double-encoded external URLs can trigger the issue, depending on which validation path is used. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability in Apache CXF’s OpenID Connect (OIDC) relying-party component represents a critical security flaw classified as an Unvalidated Redirect and Forward Vulnerability under CWE-601. This specific implementation error allows for open redirect attacks that can be leveraged to facilitate phishing campaigns or session hijacking attempts against users who have successfully authenticated through the OIDC provider. The core of the issue lies in how the application handles state parameters during the OAuth 2.0 and OIDC authorization code flow, specifically regarding the validation of post-authentication redirection targets.
During a standard OIDC authentication sequence, an application redirects a user to an identity provider with a unique state parameter to maintain context across the redirect loop. Upon successful authentication, the identity provider redirects the user back to the relying party’s callback endpoint, including this state parameter in the response. The vulnerability arises because Apache CXF preserves and utilizes these attacker-controlled state parameters as direct targets for redirection without performing sufficient validation to ensure that the final decoded Uniform Resource Identifier (URI) belongs to the trusted origin of the relying party. This lack of strict domain verification creates a pathway for malicious actors to manipulate the authentication flow.
The exploitability of this flaw is heightened by its ability to bypass common security controls through encoding variations. Attackers can craft payloads using both directly encoded external URLs and double-encoded variants, depending on which validation path within the CXF codebase is triggered during processing. This flexibility allows adversaries to evade basic string matching or simple domain checks that might only inspect one level of URL decoding. By carefully constructing these malicious redirect links, an attacker can trick a user into believing they are still interacting with the legitimate application while being silently redirected to a phishing site controlled by the adversary.
The operational impact of this vulnerability is significant for any organization relying on Apache CXF for identity federation or single sign-on capabilities. Successful exploitation enables attackers to bypass multi-factor authentication protections if the redirect occurs after MFA verification, thereby undermining the security posture established by the identity provider. Furthermore, it facilitates credential harvesting through sophisticated phishing pages that mimic legitimate login portals. Users who interact with these malicious links may inadvertently disclose sensitive credentials or personal information to unauthorized third parties, leading to potential data breaches and loss of trust in the authentication infrastructure.
To mitigate this risk, organizations must immediately upgrade Apache CXF to version 4.2.4, 4.1.9, or 3.6.13, as these releases contain patches that enforce strict validation on redirect URIs. In addition to upgrading, security teams should implement defense-in-depth strategies by configuring allowlists for valid callback URLs and ensuring that the application strictly validates the origin of any redirection target against a predefined list of trusted domains. Monitoring logs for unusual patterns in state parameters or unexpected redirects can also aid in early detection of exploitation attempts. Aligning these practices with MITRE ATT&CK techniques such as T1566.002 (Spearphishing Link) and T1078 (Valid Accounts) helps in building a more resilient security architecture against identity-based attacks.