CVE-2026-71575: Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter
The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.2.4 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.6.13
Event History
Frequently Asked Questions
Who is affected by this issue?
Relying parties that use Apache CXF's OidcClientCodeRequestFilter and have configured setMaxAgeOffset to require fresh authentication are affected. Sessions of any age may be accepted despite the intended re-authentication policy.
What does an attacker need to exploit it?
The issue concerns reuse of an existing authentication session that should have been rejected as too old. The provided information does not identify any additional attacker prerequisites.
Which versions contain the fix?
Upgrade to Apache CXF 4.2.4, 4.1.9, or 3.6.13. These versions fix the max_age authentication-freshness check.