Apache CXF CVE-2026-57817

Exploitation requires two simultaneous conditions: first, Apache CXF must be deployed as an OpenID Connect Relying Party using the Hybrid Flow grant type specifically - this is the flow where both an authorization code and ID token are returned from the authorization endpoint in the same redirect response. Second, the Identity Provider integrated with that CXF RP must be non-compliant with OIDC Core 1.0 or misconfigured such that it omits the c_hash claim from issued ID tokens. Exploitation is NOT possible when the CXF RP uses Authorization Code Flow (which does not use c_hash), when the IdP correctly and consistently includes c_hash in all ID tokens, or when the CXF deployment does not use OIDC functionality at all. CVSS PR:N confirms no authentication on the CXF system is required from the attacker's perspective. The IdP misconfiguration is the primary limiting factor: in environments where all integrated IdPs are fully OIDC-compliant, this vulnerability has no viable attack path.

The vendor-assigned CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-exploitable flaw requiring no authentication, but AC:H correctly signals non-trivial exploitation - the attacker must interact with or control a non-compliant IdP that omits c_hash, a specific deployment-side precondition. SSVC assesses exploitation status as 'none' currently, consistent with the absence of a CISA KEV listing and no known public proof-of-concept; however, SSVC simultaneously rates the attack as automatable with total technical impact, indicating that once the IdP precondition is satisfied, the attack can be scripted reliably at scale. The A:H component in the vendor CVSS vector is potentially overstated: Authorization Code Substitution is primarily an authentication-bypass leading to account takeover, with confidentiality and integrity impact being the direct consequences - availability loss is at most indirect. No EPSS score was provided in the source data. The realistic attacker pool is meaningfully constrained by the need for a misconfigured or colluding IdP, but enterprise environments integrating third-party or legacy IdPs may face this condition without awareness.

An attacker who controls or has compromised a non-compliant Identity Provider - or who is positioned to intercept and modify OIDC authorization responses in transit - captures a valid authorization code issued to a victim user during a Hybrid Flow authentication. Because Apache CXF does not validate the c_hash binding between the ID token and the authorization code, the attacker substitutes their captured code into the RP's token exchange request, causing CXF to accept it and establish an authenticated session as the victim. No public exploit code has been identified at time of analysis, but SSVC rates the attack automatable once the required IdP precondition exists.