EUVD-2026-53855
GHSA-h8f8-97w2-2925
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the mandatory non-compliant IdP precondition; A:N because authentication bypass via code substitution does not directly cause availability loss.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
10DescriptionCVE.org
The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the c_hash parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the c_hash, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Articles & Coverage 1
AnalysisAI
Authorization Code Substitution in Apache CXF's OpenID Connect Relying Party implementation allows remote attackers to hijack authenticated sessions when CXF is deployed in Hybrid Flow mode with a non-compliant or misconfigured Identity Provider that omits the c_hash parameter. Successful exploitation yields full authenticated access equivalent to account takeover, with high confidentiality and integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two simultaneous conditions: first, Apache CXF must be deployed as an OpenID Connect Relying Party using the Hybrid Flow grant type specifically - this is the flow where both an authorization code and ID token are returned from the authorization endpoint in the same redirect response. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-exploitable flaw requiring no authentication, but AC:H correctly signals non-trivial exploitation - the attacker must interact with or control a non-compliant IdP that omits c_hash, a specific deployment-side precondition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade Apache CXF to version 4.2.3 (for 4.2.x deployments), 4.1.8 (for 4.0.x/4.1.x deployments), or 3.6.12 (for 3.x deployments). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache CXF deployments and determine whether OpenID Connect Hybrid Flow mode is active in production environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Cxf
View allArbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
Unsafe deserialization in Apache CXF's JMS transport allows any party able to publish to the service's JMS destination t
Remote code execution in Apache CXF (versions before 3.6.11, 4.0.0-4.1.5, and 4.2.0) arises because the fix for CVE-2025
XML External Entity injection in Apache CXF's WSDL import processing allows attackers who can influence imported WSDL or
Denial of service persists in Apache CXF due to an incomplete remediation of CVE-2026-50645, allowing unauthenticated ne
Authorization scope escalation in Apache CXF's OAuth2 Dynamic Client Registration endpoint allows any registering client
XML External Entity injection in Apache CXF's WS-Transfer module exposes SOAP endpoints to server-side file read and int
Double-spending of OAuth2 authorization codes in Apache CXF's JCacheCodeDataProvider enables issuance of multiple valid
Apache CXF's JwtRequestCodeFilter blindly copies all claims from a validly-signed JWT request object into the OAuth2 aut
Authentication bypass in Apache CXF's OIDC relying-party implementation allows network-accessible attackers to forge sel
Apache CXF's DefaultEncryptingCodeDataProvider allows captured OAuth 2.0 authorization codes to be redeemed an unlimited
Token revocation bypass in Apache CXF's DefaultEncryptingOAuthDataProvider allows revoked OAuth access and refresh token
Same weakness CWE-20 – Improper Input Validation
View allSame technique Code Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today