CVE-2026-71575

The Apache CXF framework contains a vulnerability in the OidcClientCodeRequestFilter component. The max_age authentication-freshness check is inoperative because of an inverted comparison polarity and a unit mismatch between milliseconds and seconds. This flaw allows the system to silently accept...