Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided `AbstractAdapterCredentialsFilter`, are vulnerable. An attacked can create a provisional trusted client (valid use-case) but then it can be used as a trusted client immediately without requiring the administrator approval to clear the provisional status. The 3-legged path requiring user interaction is not vulnerable and rejects provisional clients.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
Endor Patches | CVE-2026-18918, OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default https://www.endorlabs.com/vulnerability/cve-2026-18918
Warning: Critical Authorization Bypass in #EclipseLyo. CVE-2026-18918 CVSS: 9.1. This flaw can lead to authentication bypass. #Patch #Patch #Patch
Post summary
The text announces the discovery of a critical authorization bypass vulnerability (CVE‑2026‑18918) in EclipseLyo, scoring CVSS 9.1 and potentially allowing authentication bypass.