CVE-2026-71575CWE-613

CVE-2026-71575

Critical · published October 9, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
29.7
In the wild
Unconfirmed
What it is

The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00370 · 29.7th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-10-09T15:17Z
Affected products (3)
ProductVersionsFixed in
apache/cxf< 3.6.133.6.13
apache/cxf≥ 4.0.0, < 4.1.94.1.9
apache/cxf≥ 4.2.0, < 4.2.44.2.4
References (2)
https://lists.apache.org/thread/p1r9t4xl8ny7rg8wmj8nrygx35ds6vcs · [email protected]http://www.openwall.com/lists/oss-security/2026/10/09/4 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 11 OCT 03:31Z
    EPSS moved — → 0%
    epss
  • 09 OCT 10:17Z
    Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter
    cvelistv5
  • 09 OCT 10:17Z
    Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter
    cvelistv5