CVE-2026-63687: CWE-345 Insufficient Verification of Data Authenticity in Apache Software Foundation Apache CXF
Apache CXF contains a vulnerability in its JwtRequestCodeFilter where security-sensitive parameters from a signed JWT are copied into the authorization parameter map without proper exclusion. This allows an attacker who can produce a validly-signed JWT (for example, if the client_secret is compromised) to substitute critical parameters such as code_challenge, code_challenge_method, nonce, and state, undermining PKCE integrity and OpenID Connect replay protection. Fixed versions 4.2.3, 4.1.8, and 3.6.12 address this issue.
AI Analysis
Technical Summary
The vulnerability in Apache CXF's JwtRequestCodeFilter involves insufficient verification of data authenticity (CWE-345). The filter copies all claims from a signed JWT into the authorization parameter map without excluding security-sensitive parameters. An attacker with the ability to produce a validly-signed JWT can manipulate parameters that protect against replay attacks and ensure PKCE integrity, such as code_challenge, code_challenge_method, nonce, and state. This compromises the security mechanisms of OAuth 2.0 and OpenID Connect flows. The issue is resolved in Apache CXF versions 4.2.3, 4.1.8, and 3.6.12.
Potential Impact
Successful exploitation allows an attacker who can generate a validly-signed JWT to substitute critical security parameters, thereby undermining PKCE integrity and OpenID Connect replay protection. This can lead to replay attacks and potentially unauthorized access. The CVSS score of 9.1 (critical) reflects high confidentiality and integrity impact with no required privileges or user interaction.
Mitigation Recommendations
Users should upgrade Apache CXF to versions 4.2.3, 4.1.8, or 3.6.12, which contain fixes for this vulnerability. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory recommending these versions.
CVE-2026-63687: CWE-345 Insufficient Verification of Data Authenticity in Apache Software Foundation Apache CXF
Description
Apache CXF contains a vulnerability in its JwtRequestCodeFilter where security-sensitive parameters from a signed JWT are copied into the authorization parameter map without proper exclusion. This allows an attacker who can produce a validly-signed JWT (for example, if the client_secret is compromised) to substitute critical parameters such as code_challenge, code_challenge_method, nonce, and state, undermining PKCE integrity and OpenID Connect replay protection. Fixed versions 4.2.3, 4.1.8, and 3.6.12 address this issue.
CVSS v3.1
Score 9.1critical
Affected software
Apache Software Foundation
Apache CXF
pkg:maven/Apache Software Foundation/org.apache.cxf:cxf-rt-rs-security-oauth2Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Apache CXF's JwtRequestCodeFilter involves insufficient verification of data authenticity (CWE-345). The filter copies all claims from a signed JWT into the authorization parameter map without excluding security-sensitive parameters. An attacker with the ability to produce a validly-signed JWT can manipulate parameters that protect against replay attacks and ensure PKCE integrity, such as code_challenge, code_challenge_method, nonce, and state. This compromises the security mechanisms of OAuth 2.0 and OpenID Connect flows. The issue is resolved in Apache CXF versions 4.2.3, 4.1.8, and 3.6.12.
Potential Impact
Successful exploitation allows an attacker who can generate a validly-signed JWT to substitute critical security parameters, thereby undermining PKCE integrity and OpenID Connect replay protection. This can lead to replay attacks and potentially unauthorized access. The CVSS score of 9.1 (critical) reflects high confidentiality and integrity impact with no required privileges or user interaction.
Mitigation Recommendations
Users should upgrade Apache CXF to versions 4.2.3, 4.1.8, or 3.6.12, which contain fixes for this vulnerability. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory recommending these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-07-17T16:20:23.396Z
- State
- PUBLISHED
Threat ID: 6a74768abf8831d539a9b733
Added to database: 08/06/2026, 11:56:58 UTC
Last enriched: 08/13/2026, 16:58:27 UTC
Last updated: 09/19/2026, 22:01:36 UTC
Views: 58
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.