What’s Vulnerable › Vulnerabilities

CVE-2026-50627: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-12 · updated 2026-10-26
• Weakness: CWE-289

Description

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Affected products

• Apache Software Foundation Apache CXF: before 4.1.7; from 4.2.0 before 4.2.2 — fixed in 4.1.7, 4.2.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache CXF 4.1.7, 4.2.2. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/0jfzz9q992957b99tw7hodcqjfyxwb1m
• http://www.openwall.com/lists/oss-security/2026/06/11/4
• https://access.redhat.com/errata/RHSA-2026:37390
• https://access.redhat.com/security/cve/CVE-2026-50627
• https://bugzilla.redhat.com/show_bug.cgi?id=2488298
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50627.json

Get alerted when CVE-2026-50627 or the next vulnerability affects your stack