REDHAT-BUG-2511995: High severity Apache CXF vulnerability

Q: Are deployments using the default OIDC relying-party validator configuration exposed?

No. Self-issued ID tokens are not accepted by default in the validator, so the described authentication bypass requires a configuration that accepts them.

Q: What must an attacker provide to exploit this issue?

An attacker would need to submit a crafted self-issued ID token to a vulnerable OIDC relying-party validator configured to accept self-issued tokens. The vulnerable validation path does not enforce required issuer, subject, audience, time, and sub_jwk binding checks.

Q: Which Apache CXF versions contain the fix?

Upgrade to Apache CXF 4.2.3, 4.1.8, or 3.6.12. These versions fix the self-issued ID token validation issue.

Published Aug 6, 2026

Updated

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and subjwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.

Affected Software

1 affected component

Apache CXF<4.2.3, <4.1.8, <3.6.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.2.3
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.1.8
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 3.6.12

Event History

Aug 6, 2026

Data Sourced

via Red Hat·11:52 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Are deployments using the default OIDC relying-party validator configuration exposed?

No. Self-issued ID tokens are not accepted by default in the validator, so the described authentication bypass requires a configuration that accepts them.

What must an attacker provide to exploit this issue?

An attacker would need to submit a crafted self-issued ID token to a vulnerable OIDC relying-party validator configured to accept self-issued tokens. The vulnerable validation path does not enforce required issuer, subject, audience, time, and sub_jwk binding checks.

Which Apache CXF versions contain the fix?

Upgrade to Apache CXF 4.2.3, 4.1.8, or 3.6.12. These versions fix the self-issued ID token validation issue.

REDHAT-BUG-2511995: High severity Apache CXF vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Are deployments using the default OIDC relying-party validator configuration exposed?

What must an attacker provide to exploit this issue?

Which Apache CXF versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Are deployments using the default OIDC relying-party validator configuration exposed?

What must an attacker provide to exploit this issue?

Which Apache CXF versions contain the fix?