CVE-2026-18918

The record

In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided `AbstractAdapterCredentialsFilter`, are vulnerable. An attacked can create a provisional trusted client (valid use-case) but then it can be used as a trusted client immediately without requiring the administrator approval to clear the provisional status. The 3-legged path requiring user interaction is not vulnerable and rejects provisional clients.

Affected packages

Related vulnerabilities

• CVE-2026-96398 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
• CVE-2026-96384 Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful… CWE-863
• CVE-2026-96370 Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request… CWE-863
• CVE-2026-96373 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
• CVE-2026-96366 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
• CVE-2026-96356 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
• CVE-2026-84917 Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful… CWE-863
• CVE-2026-84920 Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows… CWE-863