CVE-2019-12419

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-06 · updated 2026-06-17
Weakness: CWE-863

Description

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.

Affected products

Apache Software Foundation Apache CXF: from 3.2.0 before 3.2.11; from 3.3.0 before 3.3.4 — fixed in 3.2.11, 3.3.4
Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager: 11.3.2
Oracle Corporation Enterprise Manager Base Platform: 13.2.1.0
Oracle Corporation FLEXCUBE Private Banking: 12.0.0, 12.1.0
Oracle Retail Order Broker: 15.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache CXF 3.2.11, 3.3.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-12419 or the next vulnerability affects your stack