EUVD-2026-36393
GHSA-542g-m3fx-q86f
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable endpoint bypassed without credentials when external auth is absent; only low confidentiality impact as exposure is limited to OAuth2 token metadata, with no integrity or availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
4Description PRE-NVD
AnalysisAI
Authentication bypass in Apache CXF's OAuth2 TokenIntrospectionService allows unauthenticated network access to the token introspection endpoint due to a missing 'throw' keyword in the internal security context check, causing the guard to silently pass rather than reject unauthorized callers. Affected are deployments using cxf-rt-rs-security-oauth2 versions 4.2.0-4.2.1 and all 4.1.x releases before 4.1.7 that relied solely on CXF's built-in check without independent authentication at the container or gateway layer. No public exploit code or active exploitation has been identified; vendor-confirmed patches (4.2.2 and 4.1.7) were released June 10, 2026.
Technical ContextAI
Apache CXF is an open-source Java services framework supporting JAX-WS and JAX-RS, used broadly to build SOAP and RESTful services. The affected Maven artifact is org.apache.cxf:cxf-rt-rs-security-oauth2, which implements RFC 7662 OAuth2 Token Introspection. The root cause is a programming defect - a missing 'throw' keyword in the security context validation path within TokenIntrospectionService - meaning the conditional logic that should raise an exception to reject unauthenticated callers evaluates correctly but never enforces its result. No CWE was formally assigned in the available data, but the flaw most closely matches CWE-284 (Improper Access Control) combined with CWE-390 (Detection of Error Condition Without Action), where a guard clause executes but has no enforcement effect due to the omitted throw statement.
RemediationAI
Upgrade to Apache CXF 4.2.2 (from the 4.2.x branch) or 4.1.7 (from the 4.1.x branch), both released June 10, 2026 and available via the Apache CXF download page at https://cxf.apache.org/. For Maven projects, update the version of org.apache.cxf:cxf-rt-rs-security-oauth2 to 4.2.2 or 4.1.7 accordingly. If an immediate upgrade is not feasible, enforce independent authentication on the /services/oauth2/introspect endpoint using a servlet filter, Spring Security access rule, or API gateway policy - this compensating control removes all reliance on the broken CXF-internal check and fully eliminates the attack surface regardless of patch status. Restricting network access to the introspection endpoint to known trusted resource servers (IP allowlist or network segmentation) also substantially limits exposure as an interim measure. No side effects are expected from either compensating control, as independent authentication on introspection endpoints is architecturally recommended regardless of this CVE.
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attac
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote att
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-
The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending
Authentication bypass in Apache CXF's OAuthRequestFilter affects versions prior to 4.1.7 and 4.2.0-4.2.1, where an inver
XML External Entity (XXE) processing in Apache CXF versions prior to 4.1.7 and 4.2.0-4.2.1 allows remote attackers to tr
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Conn
Token confusion in Apache CXF's JwtAccessTokenValidator allows an attacker holding a valid JWT issued for one Resource S
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attac
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a cons
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryp
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today