Executive brief
Eclipse Lyo is a library that helps applications integrate OAuth authentication and authorization. In versions 2.0.0 through 7.0.0, a flaw in the 2-legged OAuth flow allows an attacker to bypass authorization checks by using a provisional (unapproved) client credential as if it were already approved, gaining unauthorized access without administrator oversight. The 3-legged OAuth path, which requires user interaction, is unaffected by this issue.
Technical details
The vulnerability exists in the AbstractAdapterCredentialsFilter component, which is responsible for enforcing OAuth authorization checks in applications built on Eclipse Lyo. When 2-legged OAuth is enabled, an attacker can register a provisional trusted client (a legitimate use case) and then immediately use it as a fully trusted client without waiting for administrator approval. The 3-legged OAuth authorization path, which includes user interaction, correctly rejects provisional clients and is not vulnerable. The issue affects versions 2.0.0 through 7.0.0; patches were released in v6.0.1.Final (24 Aug) and v7.0.0.Beta3 (24 Aug).
Affected products
- Eclipse Lyo 2.0.0 to 7.0.0
Timeline
- 2026-08-28: disclosed
- 2026-08-24: patched: v6.0.1.Final and v7.0.0.Beta3 released