CVE-2026-50627 PUBLISHED

Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator

Assigner: apache
Reserved: 05.06.2026 Published: 12.06.2026 Updated: 12.06.2026

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Product Status

Vendor Apache Software Foundation
Product Apache CXF
Versions Default: unaffected
  • affected from 4.2.0 to 4.2.2 (excl.)
  • affected from 0 to 4.1.7 (excl.)

Credits

  • Guanping Zhang reported this vulnerability. finder

References

Problem Types

  • CWE-289 Authentication Bypass by Alternate Name CWE