Authorization code injection in Apache CXF OpenID Connect Hybrid Flow (CVE-2026-57817)

Apache CXF fails to enforce validation of the `c_hash` (authorization code hash) parameter when operating in the OpenID Connect Hybrid Flow, contrary to the requirements of the OpenID Connect Core 1.0 specification. When integrated with a non-compliant or misconfigured Identity Provider that omits the `c_hash`, a relying party built on Apache CXF is vulnerable to Authorization Code Substitution/Injection attacks. Affected versions: - Apache CXF (org.apache.cxf:cxf-rt-rs-security-sso-oidc) 4.2.0 before 4.2.3 - Apache CXF (org.apache.cxf:cxf-rt-rs-security-sso-oidc) 4.0.0 before 4.1.8 - Apache CXF (org.apache.cxf:cxf-rt-rs-security-sso-oidc) before 3.6.12 We recommend updating to: 4.2.3, 4.1.8, 3.6.12. CVSS 9.8 · our assessment: act_now Reference: https://lists.apache.org/thread/pj63c3pf7kkp1xhr53do704fwj3t3htn Details: https://vuln.today/cve/CVE-2026-57817