Threats affecting pkg:maven/Apache Software Foundation/org.apache.cxf:cxf-rt-rs-security-sso-oidc

Apache CXF contains an open redirect vulnerability in its OIDC relying-party component that allows redirection to attacker-controlled URLs after authentication. This occurs because state parameters controlled by an attacker are used as redirect targets without proper validation. Both directly and double-encoded URLs can exploit this issue. Fixed versions 4.2.4, 4.1.9, and 3.6.13 address this vulnerability.

CVE-2026-71575 is a critical vulnerability in Apache CXF affecting the OidcClientCodeRequestFilter component. Due to a milliseconds/seconds unit mismatch and inverted comparison polarity, the max_age authentication freshness check was ineffective. This flaw allows relying parties using setMaxAgeOffset to enforce re-authentication to bypass step-up authentication policies, accepting sessions of any age. The issue is fixed in Apache CXF versions 4.2.4, 4.1.9, and 3.6.13.

Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 contain a vulnerability in the OIDC relying-party token validation process. This flaw allows acceptance of self-issued ID tokens without enforcing critical claim checks such as issuer, subject, audience, time, and sub_jwk binding, potentially enabling authentication bypass with crafted tokens. By default, self-issued ID tokens are not accepted, mitigating some risk. Upgrading to versions 4.2.3, 4.1.8, or 3.6.12 addresses this issue.

CVE-2026-57817 is a high-severity vulnerability in Apache CXF related to improper input validation of the c_hash parameter in OpenID Connect Hybrid Flow. If an Apache CXF relying party (RP) integrates with a non-compliant or misconfigured Identity Provider (IdP) that omits the c_hash, the RP is vulnerable to authorization code substitution or injection attacks. Fixed versions include 4.2.3, 4.1.8, and 3.6.12.