Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator

Summary

CVE	CVE-2026-50627
State	PUBLISHED
Assigner	apache
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-06-12 10:16:22 UTC
Updated	2026-07-10 12:17:08 UTC
Description	The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Risk And Classification

Primary CVSS: v3.1 9.1 CRITICAL from [email protected]

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.005080000 probability, percentile 0.392400000 (date 2026-06-18)

Problem Types: CWE-289 | CWE-303 | CWE-289 CWE-289 Authentication Bypass by Alternate Name | CWE-303 Incorrect Implementation of Authentication Algorithm

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	9.1	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`
3.1	ADP	DECLARED	9.1	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`
3.1	ADP	CVSS	8.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`
3.1	134c704f-9b21-4f2e-91b3-4a467353bcc0	Secondary	9.1	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`
3.1	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	Secondary	8.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Apache	Cxf	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Apache Software Foundation	Apache CXF	affected 4.2.0 4.2.2 semver	Not specified
CNA	Apache Software Foundation	Apache CXF	affected 4.1.7 semver	Not specified
ADP	Red Hat	Red Hat Build Of Apache Camel 4.18.1.P1 For Spring Boot 3.5.16	Not specified	Not specified
ADP	Red Hat	Red Hat Fuse 7	Not specified	Not specified
ADP	Red Hat	Red Hat JBoss Web Server 5	Not specified	Not specified
ADP	Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	Not specified	Not specified

References

Reference	Source	Link	Tags
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50627.json	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	security.access.redhat.com
bugzilla.redhat.com/show_bug.cgi	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	bugzilla.redhat.com
access.redhat.com/security/cve/CVE-2026-50627	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	access.redhat.com
www.openwall.com/lists/oss-security/2026/06/11/4	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com	Mailing List, Third Party Advisory
access.redhat.com/errata/RHSA-2026:37390	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	access.redhat.com
lists.apache.org/thread/0jfzz9q992957b99tw7hodcqjfyxwb1m	[email protected]	lists.apache.org	Vendor Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Guanping Zhang reported this vulnerability. (en)

Additional Advisory Data

Source	Time	Event
ADP	2026-06-12T10:00:52.910Z	Reported to Red Hat.
ADP	2026-06-12T08:55:41.657Z	Made public.

Solutions

ADP: RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16

Workarounds

ADP: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

There are currently no legacy QID mappings associated with this CVE.