CVE-2026-50623 Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService

🗓️ 12 Jun 2026 08:52:05Reported by apacheType

Authentication bypass in Apache CXF TokenIntrospectionService allows unauthenticated access to introspection; upgrade to versions four point two point two or four point one point seven.

Reporter	Title	Published	Views	Family All 10
Tenable Nessus	Apache CXF < 4.1.7 / 4.2.x < 4.2.2 Multiple Vulnerabilities	16 Jun 202600:00	–	nessus
Circl	CVE-2026-50623	11 Jun 202617:20	–	circl
CVE	CVE-2026-50623	12 Jun 202608:52	–	cve
EUVD	EUVD-2026-36393	12 Jun 202608:52	–	euvd
NVD	CVE-2026-50623	12 Jun 202610:16	–	nvd
Positive Technologies	PT-2026-48845	12 Jun 202600:00	–	ptsecurity
Snyk	Missing Authentication for Critical Function	12 Jun 202611:10	–	snyk
vulnersOsv	no.ks.fiks:adresseregisteret-client (>=1.0.0 <=1.4.0), no.ks.fiks:fastlegeregisteret-client (>=1.0.0 <=1.4.0) +15 more potentially affected by CVE-2026-50623 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0 <=4.1.6)	12 Jun 202611:10	–	vulnersosv
vulnersOsv	no.ks.fiks:adresseregisteret-client (>=1.5.0 <=1.6.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0 <=1.6.0) +13 more potentially affected by CVE-2026-50623 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.2.0 <=4.2.1)	12 Jun 202611:10	–	vulnersosv
Vulnrichment	CVE-2026-50623 Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService	12 Jun 202608:52	–	vulnrichment

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.cxf:cxf-rt-rs-security-oauth2",
    "product": "Apache CXF",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.2.2",
        "status": "affected",
        "version": "4.2.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.1.7",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/ydzj8m5mqmjy13xgyj9mkk9hfff63qq7

12 Jun 2026 08:52Current

EPSS0.00371

CWE-287