# CVE-2026-79650: Apache CXF OIDC relying-party open redirect after authentication

Source: https://junglewise.ai/threats/cve-2026-79650-apache-cxf-s-oidc-relying-party-component-could-redirect-users-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-79650 · Severity: medium · CVSS 6.1 · Published 2026-10-09

Apache CXF is a web services framework that includes OpenID Connect (OIDC) authentication support for protecting applications. A vulnerability in its relying-party component could allow an attacker to redirect authenticated users to a malicious website after they successfully log in, potentially leading to credential theft or further attacks. The flaw affects how redirect URLs are validated following successful authentication.

Technologies: [Apache CXF](https://junglewise.ai/threats/technologies/apache-cxf). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-79650 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79650 being exploited in the wild.

**How severe is CVE-2026-79650?** Medium severity, with a CVSS score of 6.1, published 9 October 2026.

**Which products and versions are affected?** Apache CXF versions before 3.6.13, 4.1.9, and 4.2.4.

**Is there a fix for CVE-2026-79650?** Yes: fixed in 3.6.13, 4.1.9, 4.2.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79650 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-79650?** Check whether you run Apache CXF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.6.13, 4.1.9, 4.2.4

## Technical details

The OIDC relying-party component fails to properly validate that decoded redirect URIs belong to the relying party's origin, instead preserving and using attacker-controlled state parameters as redirect targets. Both directly encoded and double-encoded external URLs can bypass the validation depending on which code path is executed. An unauthenticated attacker can craft a malicious request to trigger the open redirect after a user authenticates.

## Affected products

- Apache CXF versions before 3.6.13, 4.1.9, and 4.2.4

## Timeline

- 2026-10-09: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/xj0x1r617j1z8jtyypngvwhckb3o205h](https://lists.apache.org/thread.html/xj0x1r617j1z8jtyypngvwhckb3o205h)

## Related threats

- [Apache CXF hash collision bypass in STS token validation](https://junglewise.ai/threats/cve-2026-97468-apache-cxf-s-ststokenvalidator-and-security-token-service-sts)
- [Apache CXF FIQL query parser ReDoS in operator search](https://junglewise.ai/threats/cve-2026-86463-apache-cxf-s-fiql-query-parser-has-a-vulnerability-in-how-it)
- [Apache CXF CompressionUtils.inflate() zip bomb](https://junglewise.ai/threats/cve-2026-78384-compressionutils-inflate-decompressed-attacker-controlled-deflate)
- [Apache CXF race condition in OAuth2 authorization code grant](https://junglewise.ai/threats/cve-2026-73179-improper-enforcement-of-single-use-authorization-code-semantics)
- [Apache CXF StaxUtils XML denial of service](https://junglewise.ai/threats/cve-2026-108039-by-default-staxutils-placed-no-limit-on-the-total-number-of)