Search: CVE-2026-57817

CVE-2026-57817 is a high-severity vulnerability in Apache CXF related to improper input validation of the c_hash parameter in OpenID Connect Hybrid Flow. If an Apache CXF relying party (RP) integrates with a non-compliant or misconfigured Identity Provider (IdP) that omits the c_hash, the RP is vulnerable to authorization code substitution or injection attacks. Fixed versions include 4.2.3, 4.1.8, and 3.6.12.