CVE-2026-50623 describes an authentication bypass vulnerability in the OAuth2 TokenIntrospectionService component of Apache CXF. The vulnerability arises because a missing 'throw' keyword in the security context check allows unauthenticated access to the introspection endpoint (/services/oauth2/introspect). This bypass is a safeguard failure that only applies if authentication was not properly enabled on the service. The vendor has addressed this issue in versions 4.2.2 and 4.1.7.

An unauthenticated attacker can access the OAuth2 token introspection endpoint if authentication is not enabled on the service, potentially exposing token validation information. The impact is limited to cases where authentication is misconfigured or disabled, reducing the overall risk. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact.

Users should upgrade Apache CXF to version 4.2.2 or 4.1.7, where this vulnerability is fixed. Additionally, ensure that authentication is properly enabled on the OAuth2 TokenIntrospectionService to prevent unauthorized access. Patch status is confirmed by the vendor advisory recommending these versions.