by Kastro
Paper/Archive/CVE-2026-63687

CVE-2026-63687

Apache Software Foundation Apache CXF — Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
32
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 20.8.208 × 204.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known or compromised) can thereby substitute the code_challenge, code_challenge_method, nonce, and state values that were set in the outer HTTP request, undermining PKCE integrity and OpenID Connect replay protection. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Affected

ProductAffectedFixed inSource
Apache CXF4.2.0 – < 4.2.34.2.3CNA
Apache CXF4.0.0 – < 4.1.84.1.8CNA
Apache CXF< 3.6.123.6.12CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/drcq4chmt0btx86f17o47j17r378hzpwrefopenwall.com/lists/oss-security/2026/08/06/22