The JwtAccessTokenValidator class in Apache CXF does not properly validate the 'aud' (Audience) claim in incoming JWT access tokens. This flaw allows an attacker possessing a valid JWT for one resource server to replay that token against a different resource server, leading to token confusion and routing attacks. Such attacks can result in unauthorized access to protected resources with full read/write capabilities across trust boundaries. The vulnerability affects Apache CXF versions including 4.0.0, 4.2.0, and versions prior to 4.1.7 and 4.2.2. The issue is tracked as CVE-2026-50627 with a CVSS v3.1 score of 9.1 (critical). Red Hat's advisory confirms the vulnerability and rates it as Important, emphasizing that no practical mitigation other than upgrading is currently available.

This vulnerability allows attackers who possess a valid JWT for one resource server to bypass authentication controls on other resource servers using Apache CXF's JwtAccessTokenValidator. This leads to unauthorized access and potential full read/write operations across trust boundaries. The impact includes confidentiality, integrity, and availability risks as indicated by the CVSS score. The flaw undermines the authentication mechanism by failing to enforce audience claim validation, which is critical for ensuring tokens are used only by intended recipients.

A fix is available in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12. Users should upgrade to these versions to remediate the vulnerability. According to the Red Hat advisory, no effective mitigation other than upgrading is currently available or meets their criteria for ease of use and stability. Therefore, applying the official patch is the recommended remediation.