Apache CXF CVE-2026-50623

Exploitation requires both of the following conditions to be simultaneously true: (1) the Apache CXF cxf-rt-rs-security-oauth2 TokenIntrospectionService is deployed and the /services/oauth2/introspect endpoint is reachable over the network from the attacker, AND (2) no authentication mechanism other than CXF's internal security context check protects the endpoint - meaning no servlet filter, Spring Security rule, API gateway policy, or container-managed authentication is in place. The Apache advisory explicitly confirms this bypass is 'a safeguard only in the case that someone forgot to enable authentication on the service,' directly establishing the exploitation precondition as a missing external auth layer rather than a universally exposed flaw. Factors that limit exploitation: any independently configured authentication on the endpoint eliminates the risk entirely; non-public network exposure reduces attacker reachability; only cxf-rt-rs-security-oauth2 versions 4.2.0-4.2.1 and all 4.1.x before 4.1.7 are confirmed affected.

Apache rated this 'moderate', consistent with the conditional nature of exploitability. No CVSS vector or EPSS score was provided in the available data, so risk signals are limited to the advisory text and vendor severity rating. Critically, the Apache advisory explicitly states the internal CXF check 'is a safeguard only in the case that someone forgot to enable authentication on the service,' meaning any deployment with authentication enforced at the servlet filter, Spring Security, API gateway, or container level is entirely unaffected. This substantially narrows real-world risk compared to a universal AV:N/PR:N flaw: exploitation is entirely contingent on an operational oversight (missing external authentication). There is no CISA KEV listing and no publicly known POC, further supporting a lower urgency posture for well-configured deployments. The primary risk population is organizations that deployed the introspection endpoint without independent authentication, trusting the CXF-internal check as their sole control.

An unauthenticated attacker who can reach the /services/oauth2/introspect endpoint on a CXF deployment lacking external authentication sends a standard RFC 7662 HTTP POST introspection request with an arbitrary access token value. Because the missing 'throw' causes the internal security check to silently succeed, the service returns token metadata - including validity status, associated scopes, client ID, and subject username - to the unauthenticated caller. No publicly known exploit code exists at time of analysis; the attack requires only standard HTTP tooling.