What is the CVSS score of EUVD-2026-53860?

EUVD-2026-53860 has a contested CVSS base score of 9.1 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-53860?

Yes, a patch is available for EUVD-2026-53860. Update the affected software to the latest version immediately.

Apache CXF EUVD-2026-53860

| CVE-2026-63687 CRITICAL

Insufficient Verification of Data Authenticity (CWE-345)

2026-08-06 apache

GHSA-7hjx-472h-3f7q

Apache Information Disclosure Red Hat Apache Cxf Apache Software Foundation

Critical

Disputed · 9.1 Vendor: apache

Severity by source

Sources disagree (Low–High)

Vendor (apache) PRIMARY

9.1 LOW

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.7 HIGH

Network vector; high complexity requires compromised client_secret; low privileges as a registered OAuth client; user interaction needed for authorization code flow; scope changes as PKCE and OIDC controls are undermined; high C/I from auth code theft enabling impersonation.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Red Hat

7.1 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 06, 2026 - 13:02 EUVD

Analysis Generated

Aug 06, 2026 - 12:24 vuln.today

DescriptionCVE.org

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known or compromised) can thereby substitute the code_challenge, code_challenge_method, nonce, and state values that were set in the outer HTTP request, undermining PKCE integrity and OpenID Connect replay protection. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Articles & Coverage 1

News Critical JWT Claim Injection in Apache CXF OAuth2 Filter - CVE-2026-63687 Aug 07, 2026

AnalysisAI

Apache CXF's JwtRequestCodeFilter blindly copies all claims from a validly-signed JWT request object into the OAuth2 authorization parameter map, including security-sensitive fields that must not be client-controlled: code_challenge, code_challenge_method, nonce, and state. Affected are all Apache CXF deployments using this filter for OAuth2/OIDC authorization code flows prior to versions 4.2.3, 4.1.8, and 3.6.12. An OAuth2 client with a known or compromised client_secret can craft a signed request JWT that overrides the PKCE parameters established in the outer HTTP request, effectively nullifying PKCE authorization code binding and OIDC replay protection. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Apache CXF is an open-source Java services framework supporting JAX-WS, JAX-RS, and OAuth2/OpenID Connect server capabilities. The JwtRequestCodeFilter implements support for JWT-Secured Authorization Requests (JAR, RFC 9101), in which OAuth2 clients may transmit request parameters as a signed JWT to ensure parameter integrity. CWE-345 (Insufficient Verification of Data Authenticity) applies because the filter merges all JWT claims into the server-side authorization parameter map without excluding parameters that should be authoritative only when supplied in the outer HTTP request - specifically the PKCE code_challenge and code_challenge_method (RFC 7636), and the OIDC nonce and state values. PKCE exists to cryptographically bind an authorization code to the initiating client; if the attacker controls the code_challenge value accepted by the server, they can later produce the matching code_verifier and redeem an intercepted authorization code. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_cxf:*:*:*:*:*:*:*:*, spanning all branches prior to the fixed releases.

RemediationAI

Upgrade Apache CXF to version 4.2.3, 4.1.8, or 3.6.12 depending on the active branch - these are the vendor-released patched versions confirmed by the advisory at https://lists.apache.org/thread/drcq4chmt0btx86f17o47j17r378hzpw. If an immediate upgrade is not feasible, remove or disable the JwtRequestCodeFilter from the CXF OAuth2 configuration; this eliminates the vulnerable code path but also disables RFC 9101 JWT-secured authorization request support for all clients, which may break integrations relying on that feature. As an additional hardening measure, audit and rotate client_secrets for all registered OAuth2 clients to reduce the ability of an attacker to produce validly-signed JWTs, though this does not fully remediate the underlying vulnerability - it only raises the bar for exploitation.