Search: CVE-2026-65583

Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 contain a vulnerability in the OIDC relying-party token validation process. This flaw allows acceptance of self-issued ID tokens without enforcing critical claim checks such as issuer, subject, audience, time, and sub_jwk binding, potentially enabling authentication bypass with crafted tokens. By default, self-issued ID tokens are not accepted, mitigating some risk. Upgrading to versions 4.2.3, 4.1.8, or 3.6.12 addresses this issue.