EUVD-2026-53859
GHSA-9rwm-8rh4-8q53
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Non-default configuration required (AC:H); attacker submits forged token unauthenticated over network (AV:N/PR:N); full identity impersonation grants high C and I with no availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.
Articles & Coverage 1
AnalysisAI
Authentication bypass in Apache CXF's OIDC relying-party implementation allows network-accessible attackers to forge self-issued ID tokens that skip all required OpenID Connect claim checks - issuer, subject, audience, time bounds, and sub_jwk binding - effectively impersonating any user identity. Affected are all Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 when the relying party is explicitly configured to accept self-issued OIDC tokens, a non-default setting. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface is constrained to a narrow set of deliberately misconfigured deployments.
Technical ContextAI
Apache CXF is a widely-used Java services framework supporting SOAP, REST, WS-*, and OIDC-based authentication. Its OIDC relying-party component validates ID tokens per OpenID Connect Core 1.0. Self-issued ID tokens (Section 7 of OIDC Core) are a specialized mode where the end-user's own device acts as the identity provider, using a locally generated key pair; the sub_jwk claim binds the token to that key. CWE-345 (Insufficient Verification of Data Authenticity) is the root cause: the CXF validator fails to enforce iss (issuer), sub (subject), aud (audience), exp/nbf (time validity), and sub_jwk (key binding) checks before accepting the token as valid. This means a crafted JWT with arbitrary identity claims passes the validator without any cryptographic or semantic verification. The CPE cpe:2.3:a:apache_software_foundation:apache_cxf:*:*:*:*:*:*:*:* indicates all maintained branches (3.6.x, 4.1.x, 4.2.x) are affected prior to their respective fix releases.
RemediationAI
The primary fix is to upgrade Apache CXF to version 4.2.3, 4.1.8, or 3.6.12 depending on the branch in use; all three releases contain the claim validation enforcement fix. The vendor advisory is at https://lists.apache.org/thread/fzj8yzgfl53gclxrcdrnrx3grcpkq51j. For deployments that cannot patch immediately, the most effective compensating control is to disable self-issued OIDC ID token acceptance in CXF's relying-party configuration; since this feature is non-default, disabling it restores the secure-by-default posture without impacting deployments that use standard federated identity providers. If the self-issued OIDC feature is a genuine business requirement, restrict access to the OIDC-protected CXF endpoints to trusted internal network segments or VPN-only paths, reducing the exposed attack surface while upgrade planning proceeds - with the trade-off of added network operational overhead.
More in Apache Cxf
View allArbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
Unsafe deserialization in Apache CXF's JMS transport allows any party able to publish to the service's JMS destination t
Remote code execution in Apache CXF (versions before 3.6.11, 4.0.0-4.1.5, and 4.2.0) arises because the fix for CVE-2025
XML External Entity injection in Apache CXF's WSDL import processing allows attackers who can influence imported WSDL or
Denial of service persists in Apache CXF due to an incomplete remediation of CVE-2026-50645, allowing unauthenticated ne
Authorization scope escalation in Apache CXF's OAuth2 Dynamic Client Registration endpoint allows any registering client
XML External Entity injection in Apache CXF's WS-Transfer module exposes SOAP endpoints to server-side file read and int
Double-spending of OAuth2 authorization codes in Apache CXF's JCacheCodeDataProvider enables issuance of multiple valid
Apache CXF's JwtRequestCodeFilter blindly copies all claims from a validly-signed JWT request object into the OAuth2 aut
Apache CXF's DefaultEncryptingCodeDataProvider allows captured OAuth 2.0 authorization codes to be redeemed an unlimited
Token revocation bypass in Apache CXF's DefaultEncryptingOAuthDataProvider allows revoked OAuth access and refresh token
Authorization Code Substitution in Apache CXF's OpenID Connect Relying Party implementation allows remote attackers to h
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today