EUVD-2026-36393
GHSA-542g-m3fx-q86f
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable endpoint bypassed without credentials when external auth is absent; only low confidentiality impact as exposure is limited to OAuth2 token metadata, with no integrity or availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
4Description PRE-NVD
AnalysisAI
Authentication bypass in Apache CXF's OAuth2 TokenIntrospectionService allows unauthenticated network access to the token introspection endpoint due to a missing 'throw' keyword in the internal security context check, causing the guard to silently pass rather than reject unauthorized callers. Affected are deployments using cxf-rt-rs-security-oauth2 versions 4.2.0-4.2.1 and all 4.1.x releases before 4.1.7 that relied solely on CXF's built-in check without independent authentication at the container or gateway layer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires both of the following conditions to be simultaneously true: (1) the Apache CXF cxf-rt-rs-security-oauth2 TokenIntrospectionService is deployed and the /services/oauth2/introspect endpoint is reachable over the network from the attacker, AND (2) no authentication mechanism other than CXF's internal security context check protects the endpoint - meaning no servlet filter, Spring Security rule, API gateway policy, or container-managed authentication is in place. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Apache rated this 'moderate', consistent with the conditional nature of exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker who can reach the /services/oauth2/introspect endpoint on a CXF deployment lacking external authentication sends a standard RFC 7662 HTTP POST introspection request with an arbitrary access token value. Because the missing 'throw' causes the internal security check to silently succeed, the service returns token metadata - including validity status, associated scopes, client ID, and subject username - to the unauthenticated caller. … |
| Remediation | Upgrade to Apache CXF 4.2.2 (from the 4.2.x branch) or 4.1.7 (from the 4.1.x branch), both released June 10, 2026 and available via the Apache CXF download page at https://cxf.apache.org/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems deploying cxf-rt-rs-security-oauth2 versions 4.2.0, 4.2.1, or any 4.1.x release prior to 4.1.7. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Authentication bypass in Apache CXF's OAuthRequestFilter affects versions prior to 4.1.7 and 4.2.0-4.2.1, where an inver
XML External Entity (XXE) processing in Apache CXF versions prior to 4.1.7 and 4.2.0-4.2.1 allows remote attackers to tr
Token confusion in Apache CXF's JwtAccessTokenValidator allows an attacker holding a valid JWT issued for one Resource S
Remote code execution in Apache CXF versions 4.2.0 through 4.2.1 and all versions prior to 4.1.7 can occur when untruste
Remote code execution in Apache CXF's JCA integration module allows attackers to achieve arbitrary code execution via JN
Share
External POC / Exploit Code
Leaving vuln.today