What is the CVSS score of EUVD-2026-53861?

EUVD-2026-53861 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for EUVD-2026-53861?

Yes, a patch is available for EUVD-2026-53861. Update the affected software to the latest version immediately.

Apache CXF EUVD-2026-53861

| CVE-2026-61466 CRITICAL

Missing Critical Step in Authentication (CWE-304)

2026-08-06 apache

GHSA-pwwh-3685-58r7

Apache Information Disclosure Apache Cxf Red Hat

9.1

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.1 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

9.6 CRITICAL

PR:L assumed because production DCR endpoints commonly require an initial access token; S:C because self-assigned scopes impact downstream resource servers beyond the AS itself; A:N as no availability impact is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:N

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Aug 06, 2026 - 13:02 EUVD

Analysis Generated

Aug 06, 2026 - 12:24 vuln.today

DescriptionCVE.org

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Articles & Coverage 1

News Critical OAuth2 Scope Escalation in Apache CXF - CVE-2026-61466 Aug 07, 2026

AnalysisAI

Authorization scope escalation in Apache CXF's OAuth2 Dynamic Client Registration endpoint allows any registering client to self-assign privileged scopes by supplying arbitrary scope values in the registration request, which the authorization server stores verbatim without validating against a server-defined allowlist. Affected versions span the 3.x, 4.1.x, and 4.2.x release lines; patched releases 3.6.12, 4.1.8, and 4.2.3 are available per the Apache advisory. No public exploit or active exploitation has been identified at time of analysis, but the straightforward exploitation path - crafting a single registration request - makes this a meaningful authorization bypass risk for any deployment exposing CXF's OAuth2 AS with Dynamic Client Registration enabled.

Technical ContextAI

Apache CXF is a widely-used Java open-source web services framework supporting SOAP, REST, WS-*, and OAuth2. The vulnerability resides in its OAuth2 authorization server (AS) component's implementation of the Dynamic Client Registration Protocol (RFC 7591). RFC 6749 and OAuth2 best practices mandate that an AS validate client-requested scopes against a server-controlled allowlist before granting or storing them; this validation step is absent in CXF. CWE-304 (Missing Critical Step in Authentication/Authorization) accurately describes the root cause: the AS omits the required scope validation during the client registration flow, persisting whatever scope string the registering client supplies. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_cxf:*:*:*:*:*:*:*:*, indicating all versions prior to the patched releases across the 3.x, 4.1.x, and 4.2.x branches.

RemediationAI

Upgrade Apache CXF to version 4.2.3, 4.1.8, or 3.6.12 as appropriate for the deployed release line, per the Apache security advisory at https://lists.apache.org/thread/2l1r16g79tpxd7fzrzr2q9oscwrjgljs. If immediate patching is not feasible, restrict or disable the Dynamic Client Registration endpoint (commonly at a path such as /services/oauth2/register) via WAF rules or network-layer ACLs so that only trusted, pre-authorized clients can reach it - note this breaks any automated client onboarding workflows that rely on open DCR. As a post-incident step regardless of patching status, audit all currently registered OAuth2 clients in the CXF AS for unexpectedly broad or privileged scope assignments, as attackers may have already registered clients with elevated scopes prior to remediation.