Apache Cxf
Monthly
Double-spending of OAuth2 authorization codes in Apache CXF's JCacheCodeDataProvider enables issuance of multiple valid access tokens from a single code. Concurrent requests to the token endpoint during the brief window between code validation and invalidation exploit the TOCTOU race condition (CWE-367), allowing an attacker in possession of a valid authorization code to obtain additional access tokens beyond the one they are entitled to. No public exploit has been identified at time of analysis, and fixed versions are available across all maintained branches.
Authorization scope escalation in Apache CXF's OAuth2 Dynamic Client Registration endpoint allows any registering client to self-assign privileged scopes by supplying arbitrary `scope` values in the registration request, which the authorization server stores verbatim without validating against a server-defined allowlist. Affected versions span the 3.x, 4.1.x, and 4.2.x release lines; patched releases 3.6.12, 4.1.8, and 4.2.3 are available per the Apache advisory. No public exploit or active exploitation has been identified at time of analysis, but the straightforward exploitation path - crafting a single registration request - makes this a meaningful authorization bypass risk for any deployment exposing CXF's OAuth2 AS with Dynamic Client Registration enabled.
Apache CXF's JwtRequestCodeFilter blindly copies all claims from a validly-signed JWT request object into the OAuth2 authorization parameter map, including security-sensitive fields that must not be client-controlled: code_challenge, code_challenge_method, nonce, and state. Affected are all Apache CXF deployments using this filter for OAuth2/OIDC authorization code flows prior to versions 4.2.3, 4.1.8, and 3.6.12. An OAuth2 client with a known or compromised client_secret can craft a signed request JWT that overrides the PKCE parameters established in the outer HTTP request, effectively nullifying PKCE authorization code binding and OIDC replay protection. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Apache CXF's OIDC relying-party implementation allows network-accessible attackers to forge self-issued ID tokens that skip all required OpenID Connect claim checks - issuer, subject, audience, time bounds, and sub_jwk binding - effectively impersonating any user identity. Affected are all Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 when the relying party is explicitly configured to accept self-issued OIDC tokens, a non-default setting. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface is constrained to a narrow set of deliberately misconfigured deployments.
Apache CXF's DefaultEncryptingCodeDataProvider allows captured OAuth 2.0 authorization codes to be redeemed an unlimited number of times, violating RFC 6749's single-use requirement. The removeCodeGrant() method that should invalidate a code after first exchange fails to do so, meaning any attacker who intercepts or obtains a legitimate authorization code can replay it repeatedly to obtain additional access tokens. No public exploit has been identified at time of analysis, and the issue is addressed in patched releases 4.2.3, 4.1.8, and 3.6.12.
Token revocation bypass in Apache CXF's DefaultEncryptingOAuthDataProvider allows revoked OAuth access and refresh tokens to remain functionally valid indefinitely - the provider continues to decrypt them successfully and TokenIntrospectionService returns active:true in direct violation of RFC 7009 and RFC 7662 mandates. All Apache CXF deployments using this built-in OAuth data provider and relying on token revocation as a security control are affected across the 3.6.x, 4.1.x, and 4.2.x branches. An attacker or suspended user who retains a revoked token can continue accessing protected resources as though revocation never occurred, bypassing intended authorization boundaries. No public exploit has been identified at time of analysis, though the attack requires no tooling beyond a standard HTTP client.
XML External Entity injection in Apache CXF's WSDL import processing allows attackers who can influence imported WSDL or XSD documents to bypass XXE protections applied to the top-level WSDL. CXF correctly hardens top-level WSDL parsing via StaxUtils, but delegates all <wsdl:import> and <xsd:import> resolution to WSDL4J, which lacks equivalent DOCTYPE and external entity restrictions - creating a security boundary mismatch that nullifies the top-level protections. No public exploit has been identified at time of analysis, but CWE-611 is a well-understood attack class with established tooling; successful exploitation against vulnerable deployments can yield arbitrary server-side file reads and SSRF. Vendor-released patches are available across three active release branches.
Authorization Code Substitution in Apache CXF's OpenID Connect Relying Party implementation allows remote attackers to hijack authenticated sessions when CXF is deployed in Hybrid Flow mode with a non-compliant or misconfigured Identity Provider that omits the c_hash parameter. Successful exploitation yields full authenticated access equivalent to account takeover, with high confidentiality and integrity impact. No public exploit has been identified at time of analysis, but SSVC classifies the attack as automatable with total technical impact once the prerequisite IdP condition is present.
Unsafe deserialization in Apache CXF's JMS transport allows any party able to publish to the service's JMS destination to achieve denial of service or, where a compatible deserialization gadget chain is present on the application classpath, remote code execution within the CXF process. All Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 are affected when the JMS transport is in use. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability class (CWE-502 with unrestricted ObjectInputStream) is well-understood and tooling such as ysoserial makes it routinely exploitable wherever gadget libraries are present.
Denial of service persists in Apache CXF due to an incomplete remediation of CVE-2026-50645, allowing unauthenticated network attackers to exhaust server resources by submitting messages containing an excessive number of MIME attachment headers. All Apache CXF deployments running versions prior to 4.2.3, 4.1.8, or 3.6.12 remain vulnerable despite having applied the prior patch. No public exploit code or active exploitation has been identified at time of analysis, but the bypass-of-fix nature of this vulnerability means any organization that patched CVE-2026-50645 and considered itself remediated must re-patch.
Uncontrolled resource consumption in Apache CXF's JAX-RS form parameter processing enables remote denial-of-service attacks against any exposed endpoint accepting form-encoded requests. The framework provides a 'maxFormParameterCount' configuration knob but sets no default ceiling, meaning unpatched deployments will parse arbitrarily large parameter sets until memory or CPU is exhausted. Fixed versions (4.2.3, 4.1.8, and 3.6.12) enforce a default cap of 500 parameters; no public exploit or CISA KEV listing has been identified at time of analysis.
Unbounded attachment ingestion in Apache CXF enables remote denial-of-service against any endpoint that processes multipart messages. Versions prior to 4.2.3, 4.1.8, and 3.6.12 imposed no default ceiling on the 'attachment-max-size' parameter, allowing attackers to exhaust server memory or processing capacity by submitting arbitrarily large attachments. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity makes this a realistic threat for internet-exposed CXF deployments.
Remote code execution in Apache CXF (versions before 3.6.11, 4.0.0-4.1.5, and 4.2.0) arises because the fix for CVE-2025-48913 was incomplete, leaving a second code path through which untrusted JMS configuration can be abused to execute code. The flaw only matters where untrusted users are permitted to supply or influence JMS transport configuration for CXF endpoints. This is a remediation-regression issue carrying no public exploit identified at time of analysis, a very low EPSS (0.10%), and SSVC exploitation status of 'none', but the technical impact is rated total.
XML External Entity injection in Apache CXF's WS-Transfer module exposes SOAP endpoints to server-side file read and internal network probing by unauthenticated remote attackers. The insecure XML parser configuration (CWE-611) affects all 3.x releases before 3.6.11, 4.0.x-4.1.x before 4.1.6, and 4.2.0 before 4.2.1. No public exploit has been identified at time of analysis, EPSS sits at the 8th percentile (0.03%), and CISA SSVC rates exploitation as 'none', placing this squarely in the patch-on-schedule rather than emergency-response category despite the broad network attack vector.
Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90) in the LDAP-backed certificate repository to retrieve certificates they are not authorized to see. Affected builds span Apache CXF 3.x before 3.6.11, 4.0.0-4.1.x before 4.1.6, and 4.2.0 before 4.2.1; the issue was reported by Apache itself and fixed in those releases. No public exploit identified at time of analysis, EPSS is very low (0.02%, 4th percentile), and CISA SSVC scores exploitation as 'none' with only 'partial' technical impact.
Double-spending of OAuth2 authorization codes in Apache CXF's JCacheCodeDataProvider enables issuance of multiple valid access tokens from a single code. Concurrent requests to the token endpoint during the brief window between code validation and invalidation exploit the TOCTOU race condition (CWE-367), allowing an attacker in possession of a valid authorization code to obtain additional access tokens beyond the one they are entitled to. No public exploit has been identified at time of analysis, and fixed versions are available across all maintained branches.
Authorization scope escalation in Apache CXF's OAuth2 Dynamic Client Registration endpoint allows any registering client to self-assign privileged scopes by supplying arbitrary `scope` values in the registration request, which the authorization server stores verbatim without validating against a server-defined allowlist. Affected versions span the 3.x, 4.1.x, and 4.2.x release lines; patched releases 3.6.12, 4.1.8, and 4.2.3 are available per the Apache advisory. No public exploit or active exploitation has been identified at time of analysis, but the straightforward exploitation path - crafting a single registration request - makes this a meaningful authorization bypass risk for any deployment exposing CXF's OAuth2 AS with Dynamic Client Registration enabled.
Apache CXF's JwtRequestCodeFilter blindly copies all claims from a validly-signed JWT request object into the OAuth2 authorization parameter map, including security-sensitive fields that must not be client-controlled: code_challenge, code_challenge_method, nonce, and state. Affected are all Apache CXF deployments using this filter for OAuth2/OIDC authorization code flows prior to versions 4.2.3, 4.1.8, and 3.6.12. An OAuth2 client with a known or compromised client_secret can craft a signed request JWT that overrides the PKCE parameters established in the outer HTTP request, effectively nullifying PKCE authorization code binding and OIDC replay protection. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Apache CXF's OIDC relying-party implementation allows network-accessible attackers to forge self-issued ID tokens that skip all required OpenID Connect claim checks - issuer, subject, audience, time bounds, and sub_jwk binding - effectively impersonating any user identity. Affected are all Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 when the relying party is explicitly configured to accept self-issued OIDC tokens, a non-default setting. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface is constrained to a narrow set of deliberately misconfigured deployments.
Apache CXF's DefaultEncryptingCodeDataProvider allows captured OAuth 2.0 authorization codes to be redeemed an unlimited number of times, violating RFC 6749's single-use requirement. The removeCodeGrant() method that should invalidate a code after first exchange fails to do so, meaning any attacker who intercepts or obtains a legitimate authorization code can replay it repeatedly to obtain additional access tokens. No public exploit has been identified at time of analysis, and the issue is addressed in patched releases 4.2.3, 4.1.8, and 3.6.12.
Token revocation bypass in Apache CXF's DefaultEncryptingOAuthDataProvider allows revoked OAuth access and refresh tokens to remain functionally valid indefinitely - the provider continues to decrypt them successfully and TokenIntrospectionService returns active:true in direct violation of RFC 7009 and RFC 7662 mandates. All Apache CXF deployments using this built-in OAuth data provider and relying on token revocation as a security control are affected across the 3.6.x, 4.1.x, and 4.2.x branches. An attacker or suspended user who retains a revoked token can continue accessing protected resources as though revocation never occurred, bypassing intended authorization boundaries. No public exploit has been identified at time of analysis, though the attack requires no tooling beyond a standard HTTP client.
XML External Entity injection in Apache CXF's WSDL import processing allows attackers who can influence imported WSDL or XSD documents to bypass XXE protections applied to the top-level WSDL. CXF correctly hardens top-level WSDL parsing via StaxUtils, but delegates all <wsdl:import> and <xsd:import> resolution to WSDL4J, which lacks equivalent DOCTYPE and external entity restrictions - creating a security boundary mismatch that nullifies the top-level protections. No public exploit has been identified at time of analysis, but CWE-611 is a well-understood attack class with established tooling; successful exploitation against vulnerable deployments can yield arbitrary server-side file reads and SSRF. Vendor-released patches are available across three active release branches.
Authorization Code Substitution in Apache CXF's OpenID Connect Relying Party implementation allows remote attackers to hijack authenticated sessions when CXF is deployed in Hybrid Flow mode with a non-compliant or misconfigured Identity Provider that omits the c_hash parameter. Successful exploitation yields full authenticated access equivalent to account takeover, with high confidentiality and integrity impact. No public exploit has been identified at time of analysis, but SSVC classifies the attack as automatable with total technical impact once the prerequisite IdP condition is present.
Unsafe deserialization in Apache CXF's JMS transport allows any party able to publish to the service's JMS destination to achieve denial of service or, where a compatible deserialization gadget chain is present on the application classpath, remote code execution within the CXF process. All Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 are affected when the JMS transport is in use. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability class (CWE-502 with unrestricted ObjectInputStream) is well-understood and tooling such as ysoserial makes it routinely exploitable wherever gadget libraries are present.
Denial of service persists in Apache CXF due to an incomplete remediation of CVE-2026-50645, allowing unauthenticated network attackers to exhaust server resources by submitting messages containing an excessive number of MIME attachment headers. All Apache CXF deployments running versions prior to 4.2.3, 4.1.8, or 3.6.12 remain vulnerable despite having applied the prior patch. No public exploit code or active exploitation has been identified at time of analysis, but the bypass-of-fix nature of this vulnerability means any organization that patched CVE-2026-50645 and considered itself remediated must re-patch.
Uncontrolled resource consumption in Apache CXF's JAX-RS form parameter processing enables remote denial-of-service attacks against any exposed endpoint accepting form-encoded requests. The framework provides a 'maxFormParameterCount' configuration knob but sets no default ceiling, meaning unpatched deployments will parse arbitrarily large parameter sets until memory or CPU is exhausted. Fixed versions (4.2.3, 4.1.8, and 3.6.12) enforce a default cap of 500 parameters; no public exploit or CISA KEV listing has been identified at time of analysis.
Unbounded attachment ingestion in Apache CXF enables remote denial-of-service against any endpoint that processes multipart messages. Versions prior to 4.2.3, 4.1.8, and 3.6.12 imposed no default ceiling on the 'attachment-max-size' parameter, allowing attackers to exhaust server memory or processing capacity by submitting arbitrarily large attachments. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity makes this a realistic threat for internet-exposed CXF deployments.
Remote code execution in Apache CXF (versions before 3.6.11, 4.0.0-4.1.5, and 4.2.0) arises because the fix for CVE-2025-48913 was incomplete, leaving a second code path through which untrusted JMS configuration can be abused to execute code. The flaw only matters where untrusted users are permitted to supply or influence JMS transport configuration for CXF endpoints. This is a remediation-regression issue carrying no public exploit identified at time of analysis, a very low EPSS (0.10%), and SSVC exploitation status of 'none', but the technical impact is rated total.
XML External Entity injection in Apache CXF's WS-Transfer module exposes SOAP endpoints to server-side file read and internal network probing by unauthenticated remote attackers. The insecure XML parser configuration (CWE-611) affects all 3.x releases before 3.6.11, 4.0.x-4.1.x before 4.1.6, and 4.2.0 before 4.2.1. No public exploit has been identified at time of analysis, EPSS sits at the 8th percentile (0.03%), and CISA SSVC rates exploitation as 'none', placing this squarely in the patch-on-schedule rather than emergency-response category despite the broad network attack vector.
Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90) in the LDAP-backed certificate repository to retrieve certificates they are not authorized to see. Affected builds span Apache CXF 3.x before 3.6.11, 4.0.0-4.1.x before 4.1.6, and 4.2.0 before 4.2.1; the issue was reported by Apache itself and fixed in those releases. No public exploit identified at time of analysis, EPSS is very low (0.02%, 4th percentile), and CISA SSVC scores exploitation as 'none' with only 'partial' technical impact.