CVE-2025-66621

Prior versions of Apache James (before 3.9.1) are vulnerable in the SASL OAuthBearer/XOAUTH2 component. The software fails to correctly validate the AUD claim of JWT payloads when introspection is not configured (CWE-345). This vulnerability allows an attacker with valid credentials to access the...