de.cezaryrk.olingo:odata-fit (5.0.1-renamed), io.github.martinhickson:picketlink-oidc (>=3.0.8, <=5.2.6) +17 more potentially affected by CVE-2026-73179 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =3.0.8, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =4.7.0, =4.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.1.8 and more Source cves: CVE-2026-73179 Source advisory: MEND:CVE-2026-73179...

cxf-rt-rs-security-oauth2: Apache CXF: Security bypass due to improper handling of authorization parameters

A flaw was found in Apache CXF. This vulnerability allows an attacker, who has compromised a client's secret, to bypass critical security protections in the authorization process. By injecting malicious values for parameters like codechallenge and nonce, the attacker can undermine the integrity o...

Authentication Bypass

org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an Authentication Bypass. The vulnerability is due to a missing throw statement in the security context check, which allows an unauthenticated network attacker to access the /services/oauth2/introspect endpoint and perform token...

no.ks.fiks:adresseregisteret-client (>=1.5.0, <=1.7.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0, <=1.7.0) +13 more potentially affected by CVE-2026-61466 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.2.0, <=4.2.2)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.2.0, =1.5.0, =1.5.0, =1.5.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.2 Source cves: CVE-2026-61466 Source advisory: SNYK:JAVA-ORGAPACHECXF-19342250...

de.cezaryrk.olingo:odata-fit (5.0.1-renamed), io.github.martinhickson:picketlink-oidc (>=3.0.8, <=5.2.6) +17 more potentially affected by CVE-2026-61466 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0, <=4.1.7)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =3.0.8, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =4.7.0, =4.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.1.7 and more Source cves: CVE-2026-61466 Source advisory: SNYK:JAVA-ORGAPACHECXF-19342250...

de.cezaryrk.olingo:odata-fit (5.0.1-renamed), io.github.martinhickson:picketlink-oidc (>=3.0.8, <=5.2.6) +17 more potentially affected by CVE-2026-68079 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0, <=4.1.7)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =3.0.8, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =4.7.0, =4.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.1.7 and more Source cves: CVE-2026-68079 Source advisory: SNYK:JAVA-ORGAPACHECXF-19341998...

Replay Attack

Overview org.apache.cxf:cxf-rt-rs-security-oauth2 is a services framework. Affected versions of this package are vulnerable to Replay Attack due to improper handling in the removeCodeGrant process. An attacker can repeatedly redeem a captured authorization code by exploiting this flaw, potentiall...

no.ks.fiks:adresseregisteret-client (>=1.5.0, <=1.7.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0, <=1.7.0) +13 more potentially affected by CVE-2026-68481 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.2.0, <=4.2.2)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.2.0, =1.5.0, =1.5.0, =1.5.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.2 Source cves: CVE-2026-68481 Source advisory: SNYK:JAVA-ORGAPACHECXF-19342003...

Operation on a Resource after Expiration or Release

Overview org.apache.cxf:cxf-rt-rs-security-oauth2 is a services framework. Affected versions of this package are vulnerable to Operation on a Resource after Expiration or Release due to improper handling of revoked tokens in the DefaultEncryptingOAuthDataProvider process. An attacker can gain...

de.cezaryrk.olingo:odata-fit (5.0.1-renamed), io.github.martinhickson:picketlink-oidc (>=3.0.8, <=5.2.6) +17 more potentially affected by CVE-2026-57818 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0, <=4.1.7)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =3.0.8, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =4.7.0, =4.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.1.7 and more Source cves: CVE-2026-57818 Source advisory: SNYK:JAVA-ORGAPACHECXF-19342222...

no.ks.fiks:adresseregisteret-client (>=1.5.0, <=1.7.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0, <=1.7.0) +13 more potentially affected by CVE-2026-57818 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.2.0, <=4.2.2)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.2.0, =1.5.0, =1.5.0, =1.5.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.2 Source cves: CVE-2026-57818 Source advisory: SNYK:JAVA-ORGAPACHECXF-19342222...

no.ks.fiks:adresseregisteret-client (>=1.5.0, <=1.7.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0, <=1.7.0) +13 more potentially affected by CVE-2026-63687 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.2.0, <=4.2.2)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.2.0, =1.5.0, =1.5.0, =1.5.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.2 Source cves: CVE-2026-63687 Source advisory: SNYK:JAVA-ORGAPACHECXF-19341995...

no.ks.fiks:adresseregisteret-client (>=1.5.0, <=1.7.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0, <=1.7.0) +13 more potentially affected by CVE-2026-57818 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.2.0, <=4.2.2)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.2.0, =1.5.0, =1.5.0, =1.5.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.2 Source cves: CVE-2026-57818 Source advisory: MEND:CVE-2026-57818...

de.cezaryrk.olingo:odata-fit (5.0.1-renamed), io.github.martinhickson:picketlink-oidc (>=3.0.8, <=5.2.6) +17 more potentially affected by CVE-2026-57818 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0, <=4.1.7)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =3.0.8, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =4.7.0, =4.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.1.7 and more Source cves: CVE-2026-57818 Source advisory: MEND:CVE-2026-57818...

de.cezaryrk.olingo:odata-fit (5.0.1-renamed), io.github.martinhickson:picketlink-oidc (>=3.0.8, <=5.2.6) +17 more potentially affected by CVE-2026-61466 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0, <=4.1.7)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =3.0.8, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =4.7.0, =4.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.1.7 and more Source cves: CVE-2026-61466 Source advisory: MEND:CVE-2026-61466...

com.github.cchacin:cucumber-common-steps (>=0.0.2, <=0.1.8), com.github.httpmock:mock-http-server-junit (>=1.0.0, <=1.1.5) +110 more potentially affected by CVE-2026-68481 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=2.6.0, <=3.6.11)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =2.6.0, =0.0.2, =1.0.0, =1.0.0, =ec2-2013-02-01, =1.7.2.230613, =1.7.2.230622, =1.0.m1, =1.0.m1, =1.0.m2, =1.1.9, =1.1.9, =2.0.0.final, =2.2.1.final and more Source cves: CVE-2026-68481 Source advisory: MEND:CVE-2026-68481...

no.ks.fiks:adresseregisteret-client (>=1.5.0, <=1.7.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0, <=1.7.0) +13 more potentially affected by CVE-2026-68481 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.2.0, <=4.2.2)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.2.0, =1.5.0, =1.5.0, =1.5.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.2 Source cves: CVE-2026-68481 Source advisory: MEND:CVE-2026-68481...

de.cezaryrk.olingo:odata-fit (5.0.1-renamed), io.github.martinhickson:picketlink-oidc (>=3.0.8, <=5.2.6) +17 more potentially affected by CVE-2026-68481 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0, <=4.1.7)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =3.0.8, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =4.7.0, =4.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.1.7 and more Source cves: CVE-2026-68481 Source advisory: MEND:CVE-2026-68481...

org.apache.cxf.fediz.systests.federation:fediz-systests-federation-oidcidpwebapp (1.7.1), org.apache.cxf.fediz:fediz-idp (1.7.1) +9 more potentially affected by CVE-2026-50634 via org.apache.cxf:cxf-rt-rs-security-jose-jaxrs (3.6.6)

org.apache.cxf:cxf-rt-rs-security-jose-jaxrs MAVEN version 3.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-rs-security-jose-jaxrs and may be impacted: -...

org.apache.cxf.systests:cxf-systests-rs-security (3.6.7), org.apache.cxf:apache-cxf (3.6.7) +5 more potentially affected by CVE-2026-50634 via org.apache.cxf:cxf-rt-rs-security-jose-jaxrs (3.6.7)

org.apache.cxf:cxf-rt-rs-security-jose-jaxrs MAVEN version 3.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-rs-security-jose-jaxrs and may be impacted: - org.apache.cxf.systests:cxf-systests-rs-security 3.6.7 -...