CVE-2026-79650: CWE-601 URL redirection to untrusted site ('open redirect') in Apache Software Foundation Apache CXF
Description
Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the RP’s origin. Both directly encoded and double-encoded external URLs can trigger the issue, depending on which validation path is used. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Affected software
Apache Software Foundation
Apache CXF
pkg:maven/Apache Software Foundation/org.apache.cxf:cxf-rt-rs-security-sso-oidcRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-79650 is an open redirect vulnerability in Apache CXF's OIDC relying-party component. The vulnerability arises from improper validation of state parameters used as redirect targets after authentication. Attackers can craft URLs with malicious redirect targets, including both directly encoded and double-encoded external URLs, which the component fails to verify against the relying party's origin. This allows redirection to untrusted sites, potentially facilitating phishing or other attacks. The issue is fixed in Apache CXF versions 4.2.4, 4.1.9, and 3.6.13.
Potential Impact
Successful exploitation allows attackers to redirect users to arbitrary, attacker-controlled URLs after authentication, which can be used for phishing or other social engineering attacks. There is no indication of remote code execution or data compromise directly from this vulnerability. No known exploits in the wild have been reported.
Mitigation Recommendations
Users should upgrade Apache CXF to versions 4.2.4, 4.1.9, or 3.6.13 or later, which contain fixes for this vulnerability. No other mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-08-25T10:36:59.090Z
- State
- PUBLISHED
Threat ID: 6ac8c31f2cdf04f6564c0cd9
Added to database: 10/09/2026, 10:34:07 UTC
Last enriched: 10/09/2026, 10:49:08 UTC
Last updated: 10/09/2026, 11:34:05 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.