CVE-2026-50627: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Other sources
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.2.2 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.1.7 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.6.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50627?
The severity of CVE-2026-50627 is rated at 30, indicating a significant risk associated with the vulnerability.
How do I fix CVE-2026-50627?
To fix CVE-2026-50627, ensure that the JwtAccessTokenValidator class properly validates the 'aud' and 'iss' claims of incoming JWT access tokens.
What kind of attacks can CVE-2026-50627 lead to?
CVE-2026-50627 can lead to Token Confusion or Routing attacks where JWTs can be misused across different Resource Servers.
Which software is affected by CVE-2026-50627?
CVE-2026-50627 affects the Apache CXF framework, specifically its JWT access token validation component.
When was CVE-2026-50627 published?
CVE-2026-50627 was published on June 11, 2026.