Improper Verification of Cryptographic Signature

Overview org.apache.cxf:cxf-rt-rs-security-sso-oidc is an Apache CXF Runtime OpenId Connect library. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the OpenID Connect Hybrid Flow when the chash parameter is not validated. An attacker can...

Allocation of Resources Without Limits or Throttling

Overview org.apache.cxf:cxf-rt-frontend-jaxrs is an Apache CXF Runtime JAX-RS Frontend Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of a default restriction on the number of form parameters in incoming messages. An attack...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the WSDL/XSD import process. An attacker can access sensitive files or internal resources by supplying crafted XML documents containing external entity references, which are processed when imported...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization process of inbound JMS ObjectMessage using native Java deserialization without type restrictions. An attacker can execute arbitrary code or cause a denial of service by submitting...

Allocation of Resources Without Limits or Throttling

Overview org.apache.cxf:cxf-core is an an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the processing of...

Missing Critical Step in Authentication

Overview org.apache.cxf:cxf-rt-rs-security-oauth2 is a services framework. Affected versions of this package are vulnerable to Missing Critical Step in Authentication in the scope parameter processing of the OAuth2 Dynamic Client Registration endpoint. An attacker can obtain unauthorized access t...

Replay Attack

Overview org.apache.cxf:cxf-rt-rs-security-oauth2 is a services framework. Affected versions of this package are vulnerable to Replay Attack due to improper handling in the removeCodeGrant process. An attacker can repeatedly redeem a captured authorization code by exploiting this flaw, potentiall...

Operation on a Resource after Expiration or Release

Overview org.apache.cxf:cxf-rt-rs-security-oauth2 is a services framework. Affected versions of this package are vulnerable to Operation on a Resource after Expiration or Release due to improper handling of revoked tokens in the DefaultEncryptingOAuthDataProvider process. An attacker can gain...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview org.apache.cxf:cxf-rt-rs-security-oauth2 is a services framework. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition due to a race condition in the JCacheCodeDataProvider process. An attacker can obtain multiple valid access tokens by...

Insufficient Verification of Data Authenticity

Overview org.apache.cxf:cxf-rt-rs-security-oauth2 is a services framework. Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the JwtRequestCodeFilter process. An attacker can override security-sensitive parameters such as codechallenge,...

Insufficient Verification of Data Authenticity

Overview org.apache.cxf:cxf-rt-rs-security-sso-oidc is an Apache CXF Runtime OpenId Connect library. Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the OIDC relying-party token validation process. An attacker can bypass authentication by...

CVE-2026-68079

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once."...

CVE-2026-68481

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and...

CVE-2026-63687

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT e.g., one whose clientsecret is known or compromised can thereby substitute th...

CVE-2026-65583

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks issuer/subject/audience/time and subjwk binding, enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in...

CVE-2026-61466

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at...

CVE-2026-57818 Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issu...

CVE-2026-57818 Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issu...

CVE-2026-57818 Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issu...

CVE-2026-61466

The Apache CXF services framework, specifically the org.apache.cxf:cxf-rt-rs-security-oauth2 package, contains a vulnerability in its OAuth2 Dynamic Client Registration endpoint. The root cause is that the authorization server accepts and stores the scope value from the client registration reques...