CVE-2026-50627 — Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator

Description (CNA)

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache CXF	affected 4.2.0 before 4.2.2; affected 4.0.0 before 4.1.7; affected 0 before 3.6.12

CWE

CWE-289

References

https://lists.apache.org/thread/0jfzz9q992957b99tw7hodcqjfyxwb1m

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/06/11/4

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Apache CXF. The `JwtAccessTokenValidator` class fails to properly validate the 'aud' (Audience) claims within incoming JSON Web Token (JWT) access tokens. This vulnerability allows an attacker to reuse a JWT, originally intended for one resource server, against a different resource server. This can lead to token confusion and routing attacks, potentially granting unauthorized access or information disclosure.