CVE-2026-50628
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A logic error in OAuthRequestFilter rejects legitimate requests from the bound IP address while blindly allowing requests from any other IP, creating an inverse security check.
Risk Assessment
The security feature may be ineffective or even harmful, allowing unauthorized external access while blocking legitimate users.
Recommendation
Upgrade to versions 4.2.2, 4.1.7, or 3.6.12, which fix this issue.
Original NVD description (English source)
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.