CVE-2026-50623: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.2.2 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.1.7 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.6.12 - Compensating control
Ensure authentication is enabled on the OAuth2 TokenIntrospectionService introspection endpoint (/services/oauth2/introspect), since the described safeguard applies only if authentication was not enabled.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50623?
CVE-2026-50623 has a medium severity rating of 4.8 according to the CVSS 3.1 metrics.
What systems are affected by CVE-2026-50623?
CVE-2026-50623 affects Apache CXF, specifically the OAuth2 TokenIntrospectionService.
How do I fix CVE-2026-50623?
To fix CVE-2026-50623, update to the latest version of Apache CXF that addresses this authentication bypass vulnerability.
What type of vulnerability is CVE-2026-50623?
CVE-2026-50623 is an authentication bypass vulnerability that allows unauthenticated access to the OAuth2 TokenIntrospectionService.
Can CVE-2026-50623 be exploited remotely?
Yes, CVE-2026-50623 can be exploited remotely by unauthenticated network attackers due to the security context issue.