Apache CXF CVE-2026-63687

The attacker must be a registered OAuth2 client in the Apache CXF deployment - or must have obtained the client_secret of an existing registered client - in order to produce a validly-signed JWT request object. The server must be configured to use the JwtRequestCodeFilter with JWT request object support (RFC 9101); CXF deployments not using this filter are not affected. The vulnerability only undermines security where PKCE (code_challenge/code_challenge_method) or OIDC replay controls (nonce, state) are in use; deployments that do not rely on these mechanisms gain no meaningful security degradation from this issue. Exploitation is further constrained by the requirement that the attacker obtain or intercept the resulting authorization code from the user's browser flow, typically requiring an additional weakness such as an open redirect or referrer exposure. What limits exploitation: anonymous or external attackers without client credentials cannot exploit this vulnerability; server deployments not using the JwtRequestCodeFilter are entirely unaffected; and the attack requires both client credential access and a mechanism to intercept the authorization code.

No CVSS score or EPSS data has been assigned by the reporter or NVD, so risk must be inferred from description and context. The precondition of a known or compromised client_secret meaningfully constrains the attack surface relative to a fully unauthenticated flaw - only registered OAuth2 clients, or parties who have stolen client credentials, can produce the required signed JWT. However, for deployments where client credentials are shared, leaked, or where the attacker is a legitimate but malicious client, the impact is significant: PKCE bypass enables authorization code interception and replay, potentially granting unauthorized access to protected resources or enabling user impersonation. The vulnerability is scoped specifically to deployments using CXF's JwtRequestCodeFilter with JWT request object support (RFC 9101); CXF installations not using this filter are unaffected. KEV status is not listed and no POC has been identified, suggesting exploitation has not been widely observed. The absence of a CVSS vector means attack vector, complexity, and privilege requirements are inferred from the description alone - these should be verified against the vendor advisory.

An attacker who operates or has compromised a registered OAuth2 client in a CXF deployment uses that client's client_secret to sign a crafted request JWT containing attacker-chosen values for code_challenge and code_challenge_method. The attacker initiates an authorization code flow targeting a legitimate user; because JwtRequestCodeFilter copies these JWT-supplied values into the authorization parameter map, the server records the attacker's code_challenge rather than the one from the outer HTTP request. If the attacker subsequently intercepts the resulting authorization code (e.g., via an open redirect or referrer leakage), they can redeem it using the corresponding code_verifier they control, bypassing PKCE protection entirely. No public POC has been identified at time of analysis.