CVE-2026-50627
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- CVSS 3.1
- 9.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - EPSS
- 4.5% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-289, CWE-303
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:cxf
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9mrv-8pvf-hf4m | Maven | org.apache.cxf:cxf-rt-rs-security-oauth2 | >=4.2.0 <4.2.2 | 4.2.2 |
| GHSA-9mrv-8pvf-hf4m | Maven | org.apache.cxf:cxf-rt-rs-security-oauth2 | <4.1.7 | 4.1.7 |