CVE-2026-65583: Apache CXF: Self-issued ID token claims validation skipped
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and subjwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.2.3 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.1.8 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.6.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65583?
CVE-2026-65583 has a risk rating of 58, indicating a medium severity vulnerability.
How do I fix CVE-2026-65583?
To fix CVE-2026-65583, ensure that your Apache CXF configuration enforces required claims validation for ID tokens.
What impact does CVE-2026-65583 have on authentication processes?
CVE-2026-65583 can enable authentication bypass by accepting self-issued ID tokens without required claim checks.
Which versions of Apache CXF are affected by CVE-2026-65583?
CVE-2026-65583 affects certain versions of Apache CXF, specifically those that do not enforce claim validation.
Is it safe to use self-issued ID tokens in my application with CVE-2026-65583?
Using self-issued ID tokens is not safe with CVE-2026-65583 due to the risk of authentication bypass.