CVE-2026-57817

OpenID Connect Hybrid Flow issue in Apache CXF RP: the RP must validate the c_hash parameter; if the IdP omits c_hash, the RP can be vulnerable to Authorization Code Substitution/Injection. Affected product/component: Apache CXF OpenID Connect implementation (RP). Root cause: missing enforcement/...

CVE-2026-28498 Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect OIDC ID Tokens. Specifically, the internal hash verification logic verifyhash...