EUVD-2026-53857
GHSA-5c8v-93q6-cjxj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-exploitable with low complexity; PR:L because attacker must have previously obtained a legitimate token; no availability impact; limited C and I since scope is bounded to the attacker's own prior authorization.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and 'introspection of a revoked token MUST return {"active":false}'. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
AnalysisAI
Token revocation bypass in Apache CXF's DefaultEncryptingOAuthDataProvider allows revoked OAuth access and refresh tokens to remain functionally valid indefinitely - the provider continues to decrypt them successfully and TokenIntrospectionService returns active:true in direct violation of RFC 7009 and RFC 7662 mandates. All Apache CXF deployments using this built-in OAuth data provider and relying on token revocation as a security control are affected across the 3.6.x, 4.1.x, and 4.2.x branches. An attacker or suspended user who retains a revoked token can continue accessing protected resources as though revocation never occurred, bypassing intended authorization boundaries. No public exploit has been identified at time of analysis, though the attack requires no tooling beyond a standard HTTP client.
Technical ContextAI
Apache CXF is a major Apache Software Foundation Java services framework supporting JAX-WS, JAX-RS, and OAuth 2.0, broadly deployed in enterprise SOA and microservices environments. The DefaultEncryptingOAuthDataProvider implements OAuth 2.0 token storage using encryption - token state is encoded in the ciphertext rather than maintained server-side in a persistent revocation store. CWE-672 (Operation on a Resource after Expiration or Release) precisely characterizes the root cause: because revocation state cannot be embedded retroactively in an already-issued ciphertext, and because no server-side revocation list is consulted during decryption or introspection, the provider has no mechanism to distinguish a valid token from a revoked one at runtime. TokenIntrospectionService (per RFC 7662) is the authoritative endpoint for determining token liveness; returning active:true for revoked tokens breaks the entire revocation contract. The CPE identifier cpe:2.3:a:apache_software_foundation:apache_cxf:*:*:*:*:*:*:*:* covers all affected versions across branches.
RemediationAI
Vendor-released patches are available: upgrade Apache CXF to version 4.2.3, 4.1.8, or 3.6.12 depending on the branch in use, per the advisory at https://lists.apache.org/thread/88c0h10yjb2b8201o1km3st71fs2zw2b. If an immediate upgrade is not feasible, implement a custom OAuthDataProvider that wraps the default implementation and maintains an explicit server-side revocation list (e.g., in Redis or a relational database) checked on every introspection request - this requires application code changes and additional infrastructure but eliminates the bypass. As a short-term compensating control, reduce OAuth token lifetimes to the shortest value operationally acceptable (e.g., seconds to a few minutes for access tokens) so that revoked tokens expire naturally within a narrow window; this reduces but does not eliminate the exposure since the window between revocation and natural expiry remains vulnerable. Avoid relying on token revocation as an immediate security response (e.g., for incident response lockouts) until the patch is applied, as the revocation guarantee is non-functional in affected versions.
More in Apache Cxf
View allArbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
Unsafe deserialization in Apache CXF's JMS transport allows any party able to publish to the service's JMS destination t
Remote code execution in Apache CXF (versions before 3.6.11, 4.0.0-4.1.5, and 4.2.0) arises because the fix for CVE-2025
XML External Entity injection in Apache CXF's WSDL import processing allows attackers who can influence imported WSDL or
Denial of service persists in Apache CXF due to an incomplete remediation of CVE-2026-50645, allowing unauthenticated ne
Authorization scope escalation in Apache CXF's OAuth2 Dynamic Client Registration endpoint allows any registering client
XML External Entity injection in Apache CXF's WS-Transfer module exposes SOAP endpoints to server-side file read and int
Double-spending of OAuth2 authorization codes in Apache CXF's JCacheCodeDataProvider enables issuance of multiple valid
Apache CXF's JwtRequestCodeFilter blindly copies all claims from a validly-signed JWT request object into the OAuth2 aut
Authentication bypass in Apache CXF's OIDC relying-party implementation allows network-accessible attackers to forge sel
Apache CXF's DefaultEncryptingCodeDataProvider allows captured OAuth 2.0 authorization codes to be redeemed an unlimited
Authorization Code Substitution in Apache CXF's OpenID Connect Relying Party implementation allows remote attackers to h
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today