CVE-2026-61466 is a vulnerability in Apache CXF's OAuth2 Dynamic Client Registration endpoint where the authorization server does not validate the 'scope' value supplied during client registration against an allowlist defined by the authorization server. This missing validation step (CWE-304) enables clients to assign themselves privileged scopes at registration time, potentially leading to unauthorized access. The vulnerability affects versions prior to 3.6.12, 4.1.8, and 4.2.3, with a critical CVSS score of 9.1. No known exploits in the wild have been reported. The vendor recommends upgrading to fixed versions 3.6.12, 4.1.8, or 4.2.3.

Clients can self-assign privileged OAuth2 scopes during dynamic client registration, potentially granting unauthorized access to protected resources. The vulnerability has a critical severity with a CVSS score of 9.1, indicating high confidentiality impact and high availability impact, but no integrity impact. This could lead to significant security breaches if exploited.

Upgrade affected Apache CXF versions to 3.6.12, 4.1.8, or 4.2.3, which include fixes for this vulnerability. No other mitigation steps are indicated. Patch status is confirmed by the vendor advisory recommending these versions.