6.1

CVE-2026-79650: apache software foundation apache cxf Open Redirect

CVSS: 6.1v3.1MediumUndergoing analysis
Published 09-10-2026Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2026-79650 is a medium (CVSS 6.1) Open Redirect vulnerability in apache software foundation apache cxf. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.4% of scored vulnerabilities.

Overall risk
24/100
0100
Low · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.20%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 09-10-2026
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the RP’s origin. Both directly encoded and double-encoded external URLs can trigger the issue, depending on which validation path is used. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.20%

Chance of exploitation in the next 30 days

Percentile

9%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

10-10-202618-10-2026
EPSS score
0.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Apache software foundation1 product
  • apache cxf≥ 4.2.0, < 4.2.4 | ≥ 4.0.0, < 4.1.9 | < 3.6.13

1 vendor · 1 product

References

2 links