CVE-2026-65583 describes an insufficient verification of data authenticity (CWE-345) in Apache CXF's OpenID Connect (OIDC) relying-party token validation. The vulnerability arises because the validator could accept self-issued ID tokens without enforcing required claim checks including issuer, subject, audience, time validity, and sub_jwk binding. This weakness allows an attacker to bypass authentication by crafting tokens that exploit these missing checks. However, the default configuration does not accept self-issued ID tokens, which limits the risk unless explicitly enabled. The Apache Software Foundation recommends upgrading to Apache CXF versions 4.2.3, 4.1.8, or 3.6.12 where this issue is fixed.

Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms relying on OIDC tokens in affected Apache CXF versions. This could lead to unauthorized access to protected resources or services that trust the token validation process. The impact is mitigated by the default rejection of self-issued tokens, but environments that enable acceptance of such tokens are at risk.

Users should upgrade Apache CXF to version 4.2.3, 4.1.8, or 3.6.12 or later to remediate this vulnerability. Since the default validator configuration does not accept self-issued ID tokens, users who do not enable acceptance of these tokens are less exposed. Review and adjust token validation configurations to avoid accepting self-issued tokens unless necessary and ensure all required claim checks are enforced.