CVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose clientsecret is known or compromised) can thereby substitute the codechallenge, codechallengemethod, nonce, and state values that were set in the outer HTTP request, undermining PKCE integrity and OpenID Connect replay protection. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.2.3 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.1.8 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.6.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63687?
CVE-2026-63687 has a risk rating of 51, indicating a moderate severity level due to its potential impact on application security.
How do I fix CVE-2026-63687?
To address CVE-2026-63687, ensure that your implementation of Apache CXF properly sanitizes parameters in the JwtRequestCodeFilter to exclude sensitive security parameters.
What applications are affected by CVE-2026-63687?
CVE-2026-63687 affects applications using Apache CXF that utilize JwtRequestCodeFilter to process signed request JWTs.
What are the implications of CVE-2026-63687?
The implications of CVE-2026-63687 include potential unauthorized access if an attacker can produce a validly-signed request JWT.
When was CVE-2026-63687 published?
CVE-2026-63687 was published on August 6, 2026.