GHSA-9mrv-8pvf-hf4m: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator

Q: What conditions must exist for an attacker to exploit this issue?

An attacker needs a JWT access token that was issued for one Resource Server and must be able to present it to a different Resource Server using the affected JwtAccessTokenValidator. The token can be replayed because the validator does not validate the token's audience claim.

Q: Which deployments are exposed?

Deployments using Apache CXF's JwtAccessTokenValidator to validate incoming JWT access tokens are affected. The provided information does not state whether this validator is enabled or used by default.

Q: What should teams do to remediate the issue?

Upgrade Apache CXF to version 4.2.2, 4.1.7, or 3.6.12. These versions fix the missing audience validation.

Published Jun 12, 2026

Updated

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Affected Software

1 affected component

Apache CXF<4.2.2, <4.1.7, <3.6.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.2.2
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.1.7
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 3.6.12

Event History

Jun 12, 2026

CVE Published

via OSV·08:55 AM

Data Sourced

via OSV·08:55 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions must exist for an attacker to exploit this issue?

An attacker needs a JWT access token that was issued for one Resource Server and must be able to present it to a different Resource Server using the affected JwtAccessTokenValidator. The token can be replayed because the validator does not validate the token's audience claim.

Which deployments are exposed?

Deployments using Apache CXF's JwtAccessTokenValidator to validate incoming JWT access tokens are affected. The provided information does not state whether this validator is enabled or used by default.

What should teams do to remediate the issue?

Upgrade Apache CXF to version 4.2.2, 4.1.7, or 3.6.12. These versions fix the missing audience validation.

GHSA-9mrv-8pvf-hf4m: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions must exist for an attacker to exploit this issue?

Which deployments are exposed?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

What conditions must exist for an attacker to exploit this issue?

Which deployments are exposed?

What should teams do to remediate the issue?