no.ks.fiks:adresseregisteret-client (>=1.5.0 <=1.6.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0 <=1.6.0) +13 more potentially affected by CVE-2026-50627 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.2.0 <=4.2.1)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.2.0, =1.5.0, =1.5.0, =1.5.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.1 Source cves: CVE-2026-50627 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339181...

CVE-2026-50627 Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' Audience claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users...

CVE-2026-50627

creationtimestamp| type| source ---|---|--- 2026-06-11 17:59:32+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnzsjocwhy2t 2026-06-15 18:10:38+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3moduz7pfex22 2026-07-03 00:04:53+00:00| seen|...