CVE-2026-18918

CVSS 9.1 (critical) · published 2026-08-28

In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided `AbstractAdapterCredentialsFilter`, are vulnerable. An attacked can create a provisional trusted client (valid use-case) but then it can be used as a trusted client immediately without requiring the administrator approval to clear the provisional status. The 3-legged path requiring user interaction is not vulnerable and rejects provisional clients.

Weakness: CWE-863

Source: NVD CVE-2026-18918

References

• https://github.com/eclipse-lyo/lyo/releases/tag/v6.0.1.Final
• https://github.com/eclipse-lyo/lyo/releases/tag/v7.0.0.Beta3
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/221

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.