CVE-2026-57817
Received Received - Intake

OpenID Connect Hybrid Flow Authorization Code Injection in Apache CXF RP

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Apache Software Foundation

Description
The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the `c_hash`, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-57817
EUVD
EUVD-2026-53855

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache cxf From 3.6.12 (inc) to 4.2.3 (inc)
apache cxf 4.2.3
apache cxf 4.1.8
apache cxf 3.6.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Apache CXF RP not validating the c_hash parameter in OpenID Connect Core 1.0 Hybrid Flow. If an Identity Provider omits this parameter, attackers can perform Authorization Code Substitution or Injection attacks.

Detection Guidance

To detect this vulnerability, check Apache CXF RP versions for compliance with OpenID Connect Core 1.0. Verify if the RP validates the c_hash parameter during Hybrid Flow. If using vulnerable versions (pre-4.2.3, 4.1.8, or 3.6.12), inspect IdP responses for missing c_hash values.

Impact Analysis

Attackers could exploit this to gain unauthorized access or manipulate authentication tokens, potentially leading to account takeover or data breaches.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access or data breaches through Authorization Code Substitution/Injection attacks if the OpenID Connect RP is integrated with a non-compliant IdP. Failure to validate the c_hash parameter may lead to improper authentication and authorization, violating data protection requirements under these regulations.

Mitigation Strategies

Upgrade Apache CXF to versions 4.2.3, 4.1.8, or 3.6.12 to address the vulnerability. Ensure the Identity Provider (IdP) is compliant with OpenID Connect Core 1.0 and includes the c_hash parameter in Hybrid Flow responses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57817. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart