CVE-2026-18918

Deferred Deferred - Pending Action

OAuth Authorization Bypass in Eclipse Lyo

Publication date: 2026-08-28

Last updated on: 2026-09-01

Assigner: Eclipse Foundation

Description

In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided `AbstractAdapterCredentialsFilter`, are vulnerable. An attacked can create a provisional trusted client (valid use-case) but then it can be used as a trusted client immediately without requiring the administrator approval to clear the provisional status. The 3-legged path requiring user interaction is not vulnerable and rejects provisional clients.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-01

Generated

2026-09-18

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-18918

EUVD

EUVD-2026-67654

Affected Vendors & Products

Vendor	Product	Version / Range
eclipse	lyo	From 2.0.0 (inc) to 7.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects Eclipse Lyo versions 2.0.0 to 7.0.0. It allows bypassing OAuth server authorization checks when 2-legged authentication is supported. Applications using Lyo's AbstractAdapterCredentialsFilter for authz filters are vulnerable. An attacker can exploit this by creating a provisional trusted client, which can then be used immediately as a trusted client without admin approval. The 3-legged authentication path requiring user interaction is not affected.

Detection Guidance

Detecting this vulnerability requires checking if Eclipse Lyo versions 2.0.0 to 7.0.0 are running and if OAuth 2-legged auth is enabled. Inspect server configurations for `AbstractAdapterCredentialsFilter` usage and provisional client approval bypasses.

Impact Analysis

An attacker could gain unauthorized access to protected resources by bypassing OAuth authorization checks. This could lead to data breaches, unauthorized actions, or privilege escalation if the application relies on Lyo's authz filters for security.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Organizations using affected Lyo versions may face regulatory penalties or reputational damage due to insufficient access controls.

Mitigation Strategies

Upgrade Eclipse Lyo to a version beyond 7.0.0. Disable 2-legged OAuth if not required. Ensure provisional client approvals are enforced by administrators before granting trusted status.

Hi! I’m here to help you understand CVE-2026-18918. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70