Threats tagged 'ghsa-9mrv-8pvf-hf4m'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.1	EPSS 4.5%	CVE-2026-50627Apache CXF · Authentication Bypass by Alternate Name Critical9.1EPSS 4.5%2026-06-12CVE Database V5CVE-2026-50627 The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue. EPSS 4.5%Vulnerability Apache Software Foundation CWE-289 #ghsa-9mrv-8pvf-hf4m	CVE Database V5	2026-06-12

Page 1 of 1