Paper/Archive/CVE-2026-71575

CVE-2026-71575

Apache Software Foundation Apache CXF — Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter

EPSS 0.4%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 29.3.293 × 205.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Affected

ProductAffectedFixed inSource

Apache CXF4.2.0 – < 4.2.44.2.4CNA

Apache CXF4.0.0 – < 4.1.94.1.9CNA

Apache CXF< 3.6.133.6.13CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/p1r9t4xl8ny7rg8wmj8nrygx35ds6vcs refopenwall.com/lists/oss-security/2026/10/09/4