CVE-2026-63687

Apache CXF JwtRequestCodeFilter exposes PKCE and OIDC replay protections by copying all claims from a signed request JWT into the authorization parameter map without excluding sensitive parameters. A adversary who can produce a validly-signed JWT (e.g., with a known/compromised client_secret) can...