Loading story…
Apache disclosed CVE-2026-48911, a moderate-severity vulnerability in Apache Answer affecting versions through 2.0.1 that can let an unauthenticated attacker take over arbitrary user accounts. The flaw stems from insufficient verification of data authenticity caused by a missing authorization check in the external-login email-binding confirmation flow, allowing abuse of the existing user confirmation process.
According to the disclosure, exploitation requires tricking a victim into clicking a crafted confirmation link, after which the attacker can bind access and seize the targeted account. Apache said the issue is fixed in Apache Answer 2.0.2 and urged users to upgrade; the vulnerability was credited to researchers tonghuaroot and yangxi.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Apache stated that Apache Answer version 2.0.2 fixes CVE-2026-48911 and recommended that users upgrade. The disclosure credited tonghuaroot and yangxi for reporting the issue.
Apache disclosed CVE-2026-48911, a moderate-severity account takeover vulnerability in Apache Answer affecting versions through 2.0.1. The flaw stems from a missing authorization check in the external-login email binding flow and can be exploited by tricking a victim into clicking a crafted confirmation link.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed five vulnerabilities in **Apache Answer** affecting versions through `2.0.0`, including a **critical** cross-site scripting issue tracked as `CVE-2026-25688`. The XSS flaw stems from insufficient sanitization of AI-generated answer content, allowing malicious script execution when users view affected pages. Apache also fixed `CVE-2026-25699`, an authorization bypass in timeline-related APIs that let authenticated users access deleted, private, or unapproved content and related revision history, potentially exposing personal information, and `CVE-2026-25700`, which left previously issued administrative tokens valid after an administrator account was suspended, deleted, or deactivated. The same release also addressed `CVE-2026-33582`, a denial-of-service bug in which a specially crafted TIFF upload could trigger excessive memory allocation and crash the server process, and `CVE-2026-34033`, which allowed authenticated users to inject arbitrary HTML into notification emails because script-related tags were not properly neutralized. Apache said all five issues are remediated in **Apache Answer `2.0.1`** and advised users to upgrade, with reports credited to Sho Odagiri, Reimar Fritz, and Andy Gill of ZephrSec Ltd.
Jun 29, 2026
Apache CXF disclosed **CVE-2026-57818**, a low-severity flaw in the OAuth2 component `org.apache.cxf:cxf-rt-rs-security-oauth2` that can let a single authorization code be redeemed multiple times. The issue stems from a time-of-check/time-of-use race condition in `JCacheCodeDataProvider`, allowing concurrent requests to obtain multiple distinct valid access tokens from one OAuth2 authorization code. The vulnerability affects Apache CXF **4.2.0 before 4.2.3**, **4.0.0 before 4.1.8**, and **3.6.x before 3.6.12**. Apache advised users to upgrade to **4.2.3**, **4.1.8**, or **3.6.12** to remediate the issue, and credited **Guanping Zhang** with reporting the bug.
Aug 6, 2026
Apache disclosed **CVE-2026-65583**, a low-severity flaw in the Apache CXF OIDC relying-party token validation logic that can cause self-issued ID tokens to be accepted without required claim checks. Missing validation may skip verification of fields such as issuer, subject, audience, time-based claims, and `sub_jwk` binding, creating a path for authentication bypass with crafted tokens in deployments that accept self-issued ID tokens. The issue affects the Apache CXF module `org.apache.cxf:cxf-rt-rs-security-sso-oidc` in versions `4.2.0` before `4.2.3`, `4.0.0` before `4.1.8`, and the `3.6.x` line before `3.6.12`. Apache said self-issued ID tokens are **not accepted by default** in the validator, but advised users to upgrade to **4.2.3**, **4.1.8**, or **3.6.12** to remediate the vulnerability. Guanping Zhang was credited with reporting the issue.
Aug 7, 2026