CVE-2026-57817

A flaw was found in Apache CXF. When operating in the OpenID Connect Hybrid Flow, Apache CXF does not enforce the validation of the chash parameter. This vulnerability allows a remote attacker, through a non-compliant or misconfigured Identity Provider IdP, to perform Authorization Code...

Improper Verification of Cryptographic Signature

Overview org.apache.cxf:cxf-rt-rs-security-sso-oidc is an Apache CXF Runtime OpenId Connect library. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the OpenID Connect Hybrid Flow when the chash parameter is not validated. An attacker can...