CVE-2026-123535 Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age

Tornado before 6.6 does not validate the maxage argument of RequestHandler.setcookie also called by setsignedcookie, setsecurecookie, and clearcookie, allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as maxage, an attacker can embed...

CVE-2026-123535

The Tornado web framework before version 6.6 is vulnerable to Cookie Attribute Injection via the max_age argument in the RequestHandler.set_cookie function (which is also used by set_signed_cookie, set_secure_cookie, and clear_cookie). Because the framework fails to validate this argument, an att...

CVE-2026-71575 Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter

The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-...

CVE-2026-71575 Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter

The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-...

CVE-2026-71575

The Apache CXF framework is vulnerable in the OidcClientCodeRequestFilter component due to an inoperative max_age authentication-freshness check. The root cause is a unit mismatch between milliseconds and seconds combined with an inverted comparison polarity . This flaw allows relying parties usi...

CVE-2026-71575: Insufficient Session Expiration

The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-...