GitHub Advisoryadvisory · Maven

GHSA-9mrv-8pvf-hf4m Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

CRITICAL Published 2026-06-12 Modified 2026-08-20 Official page ↗
Aliases
CVE-2026-50627
Ecosystem
Maven
Packages
org.apache.cxf:cxf-rt-rs-security-oauth2
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-289, CWE-303
Reviewed
2026-08-20

Affected packages

• Maven org.apache.cxf:cxf-rt-rs-security-oauth2: >= 4.2.0, < 4.2.2 → fixed in 4.2.2 • Maven org.apache.cxf:cxf-rt-rs-security-oauth2: < 4.1.7 → fixed in 4.1.7

Description

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2026-50627 The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. vulnerability

Weakness · CWE (2)

  • CWE-289 Authentication Bypass by Alternate Name weakness
  • CWE-303 Incorrect Implementation of Authentication Algorithm weakness

References