by Kastro CVE-2026-50627
Apache Software Foundation Apache CXF — Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator
Description · from the CVE record
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Affected
ProductAffectedFixed inSource
Apache CXF4.2.0 – < 4.2.24.2.2CNA
Apache CXF4.0.0 – < 4.1.74.1.7CNA
Apache CXF< 3.6.123.6.12CNA
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16see advisorysecurity-oauth2redhat-SADP
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16see advisoryoauth2-samlredhat-SADP
Red Hat Fuse 7see advisory–redhat-SADP
Red Hat Fuse 7see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform Expansion Packsee advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform Expansion Packsee advisory–redhat-SADP
Red Hat JBoss Web Server 5see advisory–redhat-SADP
Red Hat JBoss Web Server 5see advisory–redhat-SADP
Scores by source
CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
redhat-SADP (CNA)8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total