CVE-2026-18918 PUBLISHED

OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default

Assigner: eclipse
Reserved: 05.08.2026 Published: 28.08.2026 Updated: 28.08.2026

In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided AbstractAdapterCredentialsFilter, are vulnerable. An attacked can create a provisional trusted client (valid use-case) but then it can be used as a trusted client immediately without requiring the administrator approval to clear the provisional status. The 3-legged path requiring user interaction is not vulnerable and rejects provisional clients.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:L/U:Red
CVSS Score: 9.1

Product Status

Vendor Eclipse Foundation
Product Eclipse Lyo
Versions Default: unaffected
  • affected from 2.0.0 to 7.0.0 (excl.)

Credits

  • Eclipse Foundation Security Team finder

References

Problem Types

  • CWE-863 CWE

Impacts

  • CAPEC-114