CVE-2026-65583CWE-345

CVE-2026-65583

Critical · published August 6, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
19.3
In the wild
Unconfirmed
What it is

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00279 · 19.3th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-08-06T16:16Z
Affected products (3)
ProductVersionsFixed in
apache/cxf< 3.6.123.6.12
apache/cxf≥ 4.0.0, < 4.1.84.1.8
apache/cxf≥ 4.2.0, < 4.2.34.2.3
References (2)
https://lists.apache.org/thread/fzj8yzgfl53gclxrcdrnrx3grcpkq51j · [email protected]http://www.openwall.com/lists/oss-security/2026/08/06/23 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 06 AUG 11:23Z
    Apache CXF: Self-issued ID token claims validation skipped
    cvelistv5