CVE-2026-50623 Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService

🗓️ 12 Jun 2026 08:52:05Reported by GoogleType

osv

osv🔗 osv.dev👁 1 Views

Token introspection bypass allows unauthenticated access; upgrade four two two or four one seven.

Reporter	Title	Published	Views	Family All 11
Tenable Nessus	Apache CXF < 4.1.7 / 4.2.x < 4.2.2 Multiple Vulnerabilities	16 Jun 202600:00	–	nessus
Circl	CVE-2026-50623	11 Jun 202617:20	–	circl
CVE	CVE-2026-50623	12 Jun 202608:52	–	cve
Cvelist	CVE-2026-50623 Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService	12 Jun 202608:52	–	cvelist
EUVD	EUVD-2026-36393	12 Jun 202608:52	–	euvd
NVD	CVE-2026-50623	12 Jun 202610:16	–	nvd
Positive Technologies	PT-2026-48845	12 Jun 202600:00	–	ptsecurity
Snyk	Missing Authentication for Critical Function	12 Jun 202611:10	–	snyk
vulnersOsv	no.ks.fiks:adresseregisteret-client (>=1.0.0 <=1.4.0), no.ks.fiks:fastlegeregisteret-client (>=1.0.0 <=1.4.0) +15 more potentially affected by CVE-2026-50623 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0 <=4.1.6)	12 Jun 202611:10	–	vulnersosv
vulnersOsv	no.ks.fiks:adresseregisteret-client (>=1.5.0 <=1.6.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0 <=1.6.0) +13 more potentially affected by CVE-2026-50623 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.2.0 <=4.2.1)	12 Jun 202611:10	–	vulnersosv

Source	Link
openwall	www.openwall.com/lists/oss-security/2026/06/11/3
repo	www.repo.maven.apache.org/maven2
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50623.json
lists	www.lists.apache.org/thread/ydzj8m5mqmjy13xgyj9mkk9hfff63qq7
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-50623

08 Jul 2026 08:09Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.14.8

EPSS0.00371

token introspection authentication bypass unauthenticated access upgrade four two two upgrade four one seven