CVE-2026-57817

OpenID Connect Hybrid Flow issue in Apache CXF RP: the RP must validate the c_hash parameter; if the IdP omits c_hash, the RP can be vulnerable to Authorization Code Substitution/Injection. Affected product/component: Apache CXF OpenID Connect implementation (RP). Root cause: missing enforcement/...