[lyo-dev] [ANN] Lyo 6.0.1.Final and 7.0.0.Beta3 released addressing a CV

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]

[lyo-dev] [ANN] Lyo 6.0.1.Final and 7.0.0.Beta3 released addressing a CVE

From: Andrii Berezovskyi <andriib@xxxxxx>
Date: Tue, 25 Aug 2026 12:58:03 +0000
Accept-language: en-GB, en-US, sv-SE
Delivered-to: lyo-dev@xxxxxxxxxxx
Dkim-filter: OpenDKIM Filter v2.11.0 smtp-relay-2.sys.kth.se 4hTnrY5Hc6zPMdx
List-archive: <https://www.eclipse.org/mailman/private/lyo-dev/>
List-help: <mailto:lyo-dev-request@eclipse.org?subject=help>
List-subscribe: <https://www.eclipse.org/mailman/listinfo/lyo-dev>, <mailto:lyo-dev-request@eclipse.org?subject=subscribe>
List-unsubscribe: <https://www.eclipse.org/mailman/options/lyo-dev>, <mailto:lyo-dev-request@eclipse.org?subject=unsubscribe>
Thread-index: AQHdNJFdpzBkLm7PiUqgkFtBpUWb2g==
Thread-topic: [ANN] Lyo 6.0.1.Final and 7.0.0.Beta3 released addressing a CVE

Dear Lyo users,

Today we are releasing an important security update (6.0.1.Final and 7.0.0.Beta3) for issues affecting Lyo servers featuring OAuth 1.0 support. The issue affects Lyo servers with 2-legged OAuth support where your filter is based on AbstractAdapterCredentialsFilter. If you only support 3-legged OAuth or use CredentialsFilter generated by Lyo Designer, you should not be affected. We recommend that you upgrade to a patched version regardless.

CVE number assigned to this issue is CVE-2026-18918 and will be published shortly. The CVSS score is

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:L/U:Red (9.1 CRITICAL)

Best regards,
Andrew
Eclipse Lyo project lead

Prev by Date: [lyo-dev] ANN: Lyo 7.0.0.Alpha9
Previous by thread: [lyo-dev] ANN: Lyo 7.0.0.Alpha9
Index(es):
- Date
- Thread

Breadcrumbs