EUVD-2026-53860
GHSA-7hjx-472h-3f7q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network vector; high complexity requires compromised client_secret; low privileges as a registered OAuth client; user interaction needed for authorization code flow; scope changes as PKCE and OIDC controls are undermined; high C/I from auth code theft enabling impersonation.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known or compromised) can thereby substitute the code_challenge, code_challenge_method, nonce, and state values that were set in the outer HTTP request, undermining PKCE integrity and OpenID Connect replay protection. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Articles & Coverage 1
AnalysisAI
Apache CXF's JwtRequestCodeFilter blindly copies all claims from a validly-signed JWT request object into the OAuth2 authorization parameter map, including security-sensitive fields that must not be client-controlled: code_challenge, code_challenge_method, nonce, and state. Affected are all Apache CXF deployments using this filter for OAuth2/OIDC authorization code flows prior to versions 4.2.3, 4.1.8, and 3.6.12. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be a registered OAuth2 client in the Apache CXF deployment - or must have obtained the client_secret of an existing registered client - in order to produce a validly-signed JWT request object. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS score or EPSS data has been assigned by the reporter or NVD, so risk must be inferred from description and context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Apache CXF to version 4.2.3, 4.1.8, or 3.6.12 depending on the active branch - these are the vendor-released patched versions confirmed by the advisory at https://lists.apache.org/thread/drcq4chmt0btx86f17o47j17r378hzpw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Cxf
View allArbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
Unsafe deserialization in Apache CXF's JMS transport allows any party able to publish to the service's JMS destination t
Remote code execution in Apache CXF (versions before 3.6.11, 4.0.0-4.1.5, and 4.2.0) arises because the fix for CVE-2025
XML External Entity injection in Apache CXF's WSDL import processing allows attackers who can influence imported WSDL or
Denial of service persists in Apache CXF due to an incomplete remediation of CVE-2026-50645, allowing unauthenticated ne
Authorization scope escalation in Apache CXF's OAuth2 Dynamic Client Registration endpoint allows any registering client
XML External Entity injection in Apache CXF's WS-Transfer module exposes SOAP endpoints to server-side file read and int
Double-spending of OAuth2 authorization codes in Apache CXF's JCacheCodeDataProvider enables issuance of multiple valid
Authentication bypass in Apache CXF's OIDC relying-party implementation allows network-accessible attackers to forge sel
Apache CXF's DefaultEncryptingCodeDataProvider allows captured OAuth 2.0 authorization codes to be redeemed an unlimited
Token revocation bypass in Apache CXF's DefaultEncryptingOAuthDataProvider allows revoked OAuth access and refresh token
Authorization Code Substitution in Apache CXF's OpenID Connect Relying Party implementation allows remote attackers to h
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today