Apache CXF CVE-2026-61466

Exploitation requires three conditions to hold simultaneously: (1) the target deployment uses Apache CXF as an OAuth2 authorization server - deployments using CXF solely as a REST/SOAP service framework without the OAuth2 AS component are not affected; (2) the Dynamic Client Registration endpoint is enabled and reachable by the attacker - if DCR is disabled or restricted to an internal network segment, external attackers cannot exploit this; (3) the AS's issued access tokens are honored by downstream resource servers based on the scope claim without independent scope re-validation. Authentication requirements for the DCR endpoint itself are not explicitly stated in the description or CVSS vector (no score provided); RFC 7591 permits both open and initial-access-token-protected DCR endpoints, so whether PR:N or PR:L applies depends on operator configuration and is not confirmed from available data. Exploitation is limited to scopes that the downstream resource servers recognize and enforce - if an RS ignores unknown scopes, self-assigning them yields no practical access.

No official CVSS vector or EPSS score was provided, so risk signals are limited to the description and patch data. The attack surface is a network-accessible HTTP endpoint (OAuth2 DCR), the exploit logic is conceptually trivial (supply a crafted scope string in a standard registration call), and the impact is authorization bypass - clients can obtain access tokens scoped to privileges they were never authorized to hold. The absence of KEV listing and no reported POC suggests active exploitation has not yet materialized, but the low barrier to abuse means a motivated attacker could operationalize this without specialized tooling. Risk is conditional: deployments that do not use CXF's OAuth2 AS component, or that do not expose the Dynamic Client Registration endpoint, are entirely unaffected. If downstream resource servers independently validate scopes at access time (rather than trusting the AS-issued scope claim blindly), the impact may be partially mitigated at the resource layer. The combination of a simple attack path, potential for privilege escalation across API surfaces, and multi-version impact across three active release branches makes this a high-priority patching item for affected deployments despite the lack of confirmed exploitation.

An attacker sends a crafted HTTP POST to Apache CXF's OAuth2 Dynamic Client Registration endpoint, including a scope field set to privileged scope values (for example, admin:read admin:write data:export) that the attacker was never authorized to hold. The AS stores the request verbatim and returns valid client credentials. The attacker then uses those credentials in a standard token request to obtain access tokens bearing the self-assigned privileged scopes, and subsequently calls protected API resources as if they were an authorized privileged client.