CyberRota Analysis
AI-GeneratedEclipse Lyo versions 2.0.0 to 7.0.0 are vulnerable due to a flaw in the OAuth server authorization checks, allowing attackers to bypass authorization filters when 2-legged authentication is supported. This critical vulnerability enables an attacker to exploit provisional trusted client status without administrator approval, potentially leading to unauthorized access. Organizations using affected versions of Eclipse Lyo should prioritize immediate remediation to mitigate the risk of unauthorized access to sensitive resources.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided `AbstractAdapterCredentialsFilter`, are vulnerable. An attacked can create a provisional trusted client (valid use-case) but then it can be used as a trusted client immediately without requiring the administrator approval to clear the provisional status. The 3-legged path requiring user interaction is not vulnerable and rejects provisional clients.