CVE-2026-50627
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' claims of JWT access tokens, allowing token replay across different resource servers and enabling Token Confusion/Routing attacks.
Risk Assessment
An attacker could gain unauthorized access to different resource servers, potentially compromising data confidentiality and integrity.
Recommendation
Upgrade to versions 4.2.2, 4.1.7, or 3.6.12, which fix this issue.
Original NVD description (English source)
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.