https://seclists.org/oss-sec/2026/q4/547: CVE-2025-66621: Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
Published Nov 6, 2026
·Updated
Affected Software
1 affected component
Apache James>=3.9.0<3.9.1
Apache James 3.9.0 installations are affected when SASL OAuthBearer/XOAUTH2 is used and token introspection is not configured. The issue is fixed in Apache James 3.9.1.
An attacker needs valid credentials, including a JWT, but does not need to be authorized for the target mail server. The missing or incorrect audience validation can allow that token to be accepted.
The advisory identifies deployments without introspection configured as affected. It does not state whether introspection is disabled by default.
Configure JWT audience claim validation and enable token introspection. The fixed release enforces explicit audience-claim configuration and introspection.