GHSA-9mrv-8pvf-hf4m
Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.cxf:cxf-rt-rs-security-oauth2 | >= 4.2.0, < 4.2.2 | 4.2.2 |
| Maven | org.apache.cxf:cxf-rt-rs-security-oauth2 | < 4.1.7 | 4.1.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2026-50627
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/security/cve/CVE-2026-50627
- https://bugzilla.redhat.com/show_bug.cgi?id=2488298
- https://github.com/apache/cxf
- https://lists.apache.org/thread/0jfzz9q992957b99tw7hodcqjfyxwb1m
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50627.json
- http://www.openwall.com/lists/oss-security/2026/06/11/4