CVE-2026-57817

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the "chash" parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider IdP that omits the "chash", the RP becomes vulnerable to Authorization Co...