CVE-2025-66621: Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred

Published Nov 6, 2026

Updated

Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.

This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.

We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache James to a version that resolves this vulnerability.
Fixed in 3.9.1

Event History

Nov 6, 2026

CVE Published

via MITRE·11:38 AM

Data Sourced

via MITRE·11:38 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed?

Apache James deployments using SASL OAuthBearer or XOAUTH2 in versions prior to 3.9.1 are affected when token introspection is not configured.

What does an attacker need to exploit this issue?

The attacker needs valid credentials represented by a JWT, but does not need to be authorized for the target mail server if the JWT audience claim is not correctly validated.

What should be done if the server cannot be upgraded immediately?

Configure token introspection and explicitly configure validation of JWT audience claims. The fixed version enforces explicit audience-claim configuration and introspection.

CVE-2025-66621: Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What should be done if the server cannot be upgraded immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What should be done if the server cannot be upgraded immediately?