CRITICAL🇵🇱 Wersja polska

CVE-2026-61466

CVSS 9.1v3.1pub. 2026-08-06upd. 2026-08-07

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

  • Apache Cxf

    APP
    Apache
    < 3.6.124.0.0 – 4.1.8 (excl.)4.2.0 – 4.2.3 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-66909CRITICAL9.8PL ✓same product

Apache CXF: RCE przez niebezpieczną deserializację JMS ObjectMessage

CVE-2026-68079CRITICAL9.8PL ✓same product

Apache CXF: wielokrotne użycie kodu autoryzacyjnego OAuth (CWE-294)

CVE-2026-63687CRITICAL9.1PL ✓same product

Apache CXF: podmiana parametrów PKCE i OIDC przez JWT w JwtRequestCodeFilter

CVE-2026-65583CRITICAL9.1PL ✓same product

Apache CXF: pominięcie walidacji tokenów OIDC umożliwia authentication bypass

CVE-2026-50627CRITICAL9.1PL ✓same product

Apache CXF: brak walidacji pola 'aud' w tokenach JWT — Token Confusion