CVE-2026-50627
Full vulnerability record from the local CVENow database.
Description
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Severity
CRITICAL
CVSS score
9.1
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-06-12 10:16:22.587000
Last modified
2026-10-26 11:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-50627",
"sourceIdentifier": "[email protected]",
"published": "2026-06-12T10:16:22.587",
"lastModified": "2026-10-26T11:10:00.157",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue."
},
{
"lang": "es",
"value": "La clase JwtAccessTokenValidator en Apache CXF no valida las reclamaciones ’aud’ (Audiencia) de los tokens de acceso JWT entrantes. Esto permite que un JWT emitido para un Servidor de Recursos sea reproducido con éxito contra un Servidor de Recursos completamente diferente, lo que lleva a ataques de Confusión/Enrutamiento de Tokens. Se recomienda a los usuarios actualizar a las versiones 4.2.2 o 4.1.7, que corrige este problema."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Apache Software Foundation",
"product": "Apache CXF",
"defaultStatus": "unaffected",
"collectionURL": "https://repo.maven.apache.org/maven2",
"packageName": "org.apache.cxf:cxf-rt-rs-security-oauth2",
"versions": [
{
"version": "4.2.0",
"lessThan": "4.2.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "4.0.0",
"lessThan": "4.1.7",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "3.6.12",
"versionType": "semver",
"status": "affected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cxf-rt-rs",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"versions": [
{
"version": "security-oauth2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cxf-rt-rs-security",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"versions": [
{
"version": "oauth2-saml",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Fuse 7",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cxf-rt-rs-security-oauth2",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Fuse 7",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cxf-rt-rs-security-oauth2-saml",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cxf-rt-rs-security-oauth2",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cxf-rt-rs-security-oauth2-saml",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Web Server 5",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cxf-rt-rs-security-oauth2",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_web_server:5"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Web Server 5",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cxf-rt-rs-security-oauth2-saml",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_web_server:5"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.3,
"impactScore": 6.0
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.3,
"impactScore": 6.0
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-15T18:31:53.486235Z",
"id": "CVE-2026-50627",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-289"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-303"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.7",
"matchCriteriaId": "C0505632-D713-4EFC-B857-12EBD5C3DF33"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.2.0",
"versionEndExcluding": "4.2.2",
"matchCriteriaId": "B1BF06FC-96AD-4663-9959-1B1493D4A2A0"
}
]
}
]
}
],
"references": [
{
"url": "https://lists.apache.org/thread/0jfzz9q992957b99tw7hodcqjfyxwb1m",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/06/11/4",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:37390",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-50627",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488298",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50627.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}