CVE-2026-50623
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint can be accessed by any unauthenticated network attacker. Note this is a safeguard only if someone forgot to enable authentication. Upgrade to versions 4.2.2, 4.1.7, or 3.6.12.
Risk Assessment
If authentication is not enabled, an attacker could access the introspection endpoint, potentially leading to token information disclosure or misuse.
Recommendation
Upgrade Apache CXF to versions 4.2.2, 4.1.7, or 3.6.12. Ensure authentication is enabled for all OAuth2 services.
Other vulnerabilities in Apache CXF
See all- CVE-2017-3156High
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.
- CVE-2026-68079Critical
In Apache CXF's DefaultEncryptingCodeDataProvider, an authorization code can be redeemed an unlimited number of times due to a flaw in the removeCodeGrant implementation. This violates the RFC requirement that the authorization code must not be used more than once. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.
- CVE-2026-65583Critical
Apache CXF's OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. Note that self-issued ID tokens are not accepted by default. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.
- CVE-2026-63687Critical
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT can substitute code_challenge, code_challenge_method, nonce, and state values, undermining PKCE integrity and OpenID Connect replay protection. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.
- CVE-2026-61466Critical
In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.
- CVE-2026-66909Critical
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed.
- CVE-2026-50628Critical
A logic error in OAuthRequestFilter rejects legitimate requests from the bound IP address while blindly allowing requests from any other IP, creating an inverse security check.
- CVE-2026-50627Critical
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' claims of JWT access tokens, allowing token replay across different resource servers and enabling Token Confusion/Routing attacks.
- CVE-2026-49875Critical
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory construct a SAXParserFactory without proper JAXP hardening, enabling out-of-band external entity resolution.
- CVE-2026-44930Critical
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF. It allows an attacker to retrieve arbitrary certificates from the repository.
Original NVD description (English source)
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.