CVE-2026-18918: CWE-863 in Eclipse Foundation Eclipse Lyo

CVE-2026-18918 is a critical authorization bypass vulnerability (CWE-863) in Eclipse Lyo versions 2.0.0 through 7.0.0. When the OAuth server supports 2-legged authentication, applications relying on Lyo's AbstractAdapterCredentialsFilter for authorization can be bypassed. Specifically, an attacker can create a provisional trusted client, which normally requires administrator approval to become fully trusted, but due to the flaw, it can be used immediately without such approval. The 3-legged OAuth flow, which involves user interaction, is not vulnerable and correctly rejects provisional clients. No official remediation or patch has been published yet.

The vulnerability allows attackers to bypass OAuth server authorization checks in the 2-legged authentication flow, enabling them to use provisional trusted clients immediately without administrator approval. This can lead to unauthorized access and potential privilege escalation in applications using the affected versions of Eclipse Lyo with the vulnerable authorization filter. The 3-legged OAuth flow remains secure against this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, applications should avoid relying solely on the AbstractAdapterCredentialsFilter for authorization in 2-legged OAuth scenarios or implement additional manual checks to ensure provisional clients are not granted immediate trusted status.