by Kastro
Paper/Archive/CVE-2026-65583

CVE-2026-65583

Apache Software Foundation Apache CXF — Apache CXF: Self-issued ID token claims validation skipped

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
31
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 20.4.204 × 204.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.

Affected

ProductAffectedFixed inSource
Apache CXF4.2.0 – < 4.2.34.2.3CNA
Apache CXF4.0.0 – < 4.1.84.1.8CNA
Apache CXF< 3.6.123.6.12CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/fzj8yzgfl53gclxrcdrnrx3grcpkq51jrefopenwall.com/lists/oss-security/2026/08/06/23