CVE-2026-65583
Received Received - Intake

OIDC Token Validation Bypass in Apache CXF

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Apache Software Foundation

Description
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-65583
EUVD
EUVD-2026-53859

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
apache cxf From 4.2.3 (inc)
apache cxf From 4.1.8 (inc)
apache cxf From 3.6.12 (inc)
apache cxf 4.2.3
apache cxf 4.1.8
apache cxf 3.6.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache CXF’s OIDC token validator fails to properly check required claims in self-issued ID tokens, allowing authentication bypass with specially crafted tokens. The validator does not enforce checks for issuer, subject, audience, time, or sub_jwk binding by default.

Detection Guidance

Check Apache CXF version using commands like 'cxf --version' or inspect dependency files (e.g., pom.xml for Maven). Monitor logs for unusual authentication attempts or failed token validations. Review OIDC token validation configurations for missing issuer/subject/audience/time checks.

Impact Analysis

An attacker could exploit this to bypass authentication and gain unauthorized access to protected resources by sending a maliciously crafted token that the validator accepts as valid.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Apache CXF versions may fail compliance audits if the issue is not addressed.

Mitigation Strategies

Upgrade Apache CXF to versions 4.2.3, 4.1.8, or 3.6.12 immediately. If upgrading is not possible, disable self-issued ID token acceptance in OIDC relying-party configurations. Apply strict validation rules for issuer, subject, audience, time, and sub_jwk claims.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65583. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart