CVE-2026-50627: CWE-289 Authentication Bypass by Alternate Name in Apache Software Foundation Apache CXF
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
AI Analysis
Technical Summary
The JwtAccessTokenValidator class in Apache CXF fails to properly validate the 'aud' claim in JWT access tokens. This improper validation permits a JWT token intended for one Resource Server to be accepted by another, resulting in token confusion or routing attacks. The vulnerability is identified as CWE-289 (Authentication Bypass) and CWE-303 (Incorrect Implementation of Security Check). The CVSS v3.1 base score is 9.1, indicating a critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. The vulnerability affects Apache CXF version 4.2.0. Vendor advisories recommend upgrading to fixed versions 4.2.2 or 4.1.7.
Potential Impact
Successful exploitation allows an attacker to reuse a JWT access token issued for one Resource Server on a different Resource Server, bypassing intended authentication boundaries. This can lead to unauthorized access, data compromise, and potential disruption of services relying on token-based authentication.
Mitigation Recommendations
A fix is available. Users should upgrade Apache CXF to versions 4.2.2 or 4.1.7 as recommended by the vendor and Red Hat advisory. No additional mitigations are specified beyond applying the official patch.
CVE-2026-50627: CWE-289 Authentication Bypass by Alternate Name in Apache Software Foundation Apache CXF
Description
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
CVSS v3.1
Score 9.1critical
Affected software
pkg:maven/Apache Software Foundation/org.apache.cxf:cxf-rt-rs-security-oauth2Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The JwtAccessTokenValidator class in Apache CXF fails to properly validate the 'aud' claim in JWT access tokens. This improper validation permits a JWT token intended for one Resource Server to be accepted by another, resulting in token confusion or routing attacks. The vulnerability is identified as CWE-289 (Authentication Bypass) and CWE-303 (Incorrect Implementation of Security Check). The CVSS v3.1 base score is 9.1, indicating a critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. The vulnerability affects Apache CXF version 4.2.0. Vendor advisories recommend upgrading to fixed versions 4.2.2 or 4.1.7.
Potential Impact
Successful exploitation allows an attacker to reuse a JWT access token issued for one Resource Server on a different Resource Server, bypassing intended authentication boundaries. This can lead to unauthorized access, data compromise, and potential disruption of services relying on token-based authentication.
Mitigation Recommendations
A fix is available. Users should upgrade Apache CXF to versions 4.2.2 or 4.1.7 as recommended by the vendor and Red Hat advisory. No additional mitigations are specified beyond applying the official patch.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-06-05T10:36:46.172Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-50627","vendor":"Red Hat"}]
Threat ID: 6a2bd75be617e2d83448bfae
Added to database: 06/12/2026, 09:54:35 UTC
Last enriched: 07/30/2026, 21:41:22 UTC
Last updated: 07/31/2026, 21:26:43 UTC
Views: 70
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.