Eclipse Foundation Eclipse Lyo vulnerabilities

Latest Eclipse Foundation Eclipse Lyo CVEs

Newest publication first

1. CVE-2026-18918 OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default

   Published 2026-08-28

   Critical·CVSS 9.1 EPSS 0.51%

   In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided AbstractAdapterCredentialsFilter, are vulnerable. An attacked...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.