CVE-2026-63687

A security bypass vulnerability exists in Apache CXF within the cxf-rt-rs-security-oauth2 component. The JwtRequestCodeFilter fails to exclude security-sensitive parameters when copying claims from a signed request JWT into the authorization parameter map. An attacker who possesses or compromises...