CVE-2026-18918
CriticalCVSS 9.1Summary
In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, applications that based their authz filters upon Lyo-provided AbstractAdapterCredentialsFilter are vulnerable. An attacker can create a provisional trusted client (valid use-case) but then it can be used as a trusted client immediately without requiring the administrator approval to clear the provisional status. The 3-legged path requiring user interaction is not vulnerable and rejects provisional clients.
Risk Assessment
An attacker can bypass authorization checks and gain unauthorized access to OAuth-protected resources, potentially leading to data confidentiality and integrity breaches.
Recommendation
Update Eclipse Lyo to a version newer than 7.0.0 and ensure provisional clients require administrator approval.
Original NVD description (English source)
In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided `AbstractAdapterCredentialsFilter`, are vulnerable. An attacked can create a provisional trusted client (valid use-case) but then it can be used as a trusted client immediately without requiring the administrator approval to clear the provisional status. The 3-legged path requiring user interaction is not vulnerable and rejects provisional clients.