THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-50628 (CRITICAL 9.8) — A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to v

[NVD] CVE-2026-50628 (CRITICAL 9.8) — A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to v

lownvdPublished 2026-06-12

CVE-2026-50628 CVSS: 9.8 CRITICAL Published: 2026-06-12T10:16:22.710

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this

security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this

Indicators of compromise

CVE-2026-50628cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-50628