CVE-2016-4464

Critical

Published: 21/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The application plugins in Apache CXF Fediz versions 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to bypass intended restrictions via a crafted SAML token with a trusted signature.

Risk Assessment

The organization may be exposed to attacks that exploit this vulnerability to bypass security measures, potentially leading to unauthorized access to resources.

Recommendation

It is recommended to update Apache CXF Fediz to version 1.2.3 or 1.3.1 to mitigate this vulnerability.

Original NVD description (English source)

The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.