CVE-2026-18918OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default
Updated under an hour ago ()
Does this affect you?
It affects Eclipse Foundation Eclipse Lyo. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided `AbstractAdapterCredentialsFilter`, are vulnerable. An attacked can create a provisional trusted client (valid use-case) but then it can be used as a trusted client immediately without requiring the administrator approval to clear the provisional status. The 3-legged path requiring user interaction is not vulnerable and rejects provisional clients.
- CVSS
- 9.1 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:L/U:Red
- Weakness (CWE)
- CWE-863
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- eclipse
- NVD analysis
- Deferred
- Record last updated
- Aug 31, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Eclipse Foundation Eclipse Lyo eclipse_foundation:eclipse_lyo (from the name) | from 2.0.0 before 7.0.0 | CNA record |
References
- https://github.com/eclipse-lyo/lyo/releases/tag/v6.0.1.Final
- https://github.com/eclipse-lyo/lyo/releases/tag/v7.0.0.Beta3
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/221
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.