Apache James SASL OAuthBearer/XOAUTH2 versions prior to 3.9.1 do not correctly validate the AUD claim in JWT payloads when introspection is not configured. This flaw allows attackers with valid credentials to access the mail server without proper authorization. Users are advised to upgrade to version 3.9.1 or later, which enforces explicit AUD claim configuration and introspection.