CRITICAL🇵🇱 Wersja polska

CVE-2026-65583

CVSS 9.1v3.1pub. 2026-08-06upd. 2026-08-07

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Apache Cxf

    APP
    Apache
    < 3.6.124.0.0 – 4.1.8 (excl.)4.2.0 – 4.2.3 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2026-66909CRITICAL9.8PL ✓same product

Apache CXF: RCE przez niebezpieczną deserializację JMS ObjectMessage

CVE-2026-68079CRITICAL9.8PL ✓same product

Apache CXF: wielokrotne użycie kodu autoryzacyjnego OAuth (CWE-294)

CVE-2026-61466CRITICAL9.1PL ✓same product

Apache CXF: brak walidacji scope w rejestracji klienta OAuth2

CVE-2026-63687CRITICAL9.1PL ✓same product

Apache CXF: podmiana parametrów PKCE i OIDC przez JWT w JwtRequestCodeFilter

CVE-2026-50627CRITICAL9.1PL ✓same product

Apache CXF: brak walidacji pola 'aud' w tokenach JWT — Token Confusion