Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Nov 2, 2026 | Aug 6, 2026 |
| Redhat_linux | — | Upgrade eap8-wildfly-clustering-server-localUpgrade eap8-wildfly-clustering-cache-spiUpgrade eap8-wildfly-clustering-marshalling-jbossUpgrade eap8-wildfly-clustering-marshalling-spiUpgrade eap8-netty-codec-dnsUpgrade eap8-resteasy-rxjava2Upgrade eap8-jackson-dataformats-textUpgrade eap8-netty-transport-native-epoll-debuginfoUpgrade eap8-jbossws-cxfUpgrade eap8-resteasy-jackson2-providerUpgrade eap8-nettyUpgrade eap8-wildfly-clustering-cache-infinispan-remoteUpgrade eap8-jaxb-jxcUpgrade eap8-hibernateUpgrade eap8-resteasy-core-spiUpgrade eap8-jackson-annotationsUpgrade eap8-wildfly-clustering-session-infinispan-embeddedUpgrade eap8-hibernate-enversUpgrade eap8-eap-product-conf-wildfly-ee-feature-packUpgrade eap8-wildfly-javadocsUpgrade eap8-wildfly-clustering-session-cacheUpgrade eap8-jackson-datatype-jsr310Upgrade eap8-jaxbUpgrade eap8-wildfly-modulesUpgrade eap8-resteasy-jaxb-providerUpgrade eap8-txw2Upgrade eap8-wildfly-clustering-session-spec-servlet-6.0Upgrade eap8-wildfly-clustering-cache-infinispan-commonUpgrade eap8-jboss-openjdk-orbUpgrade eap8-resteasy-json-p-providerUpgrade eap8-resteasy-validator-providerUpgrade eap8-resteasy-cdiUpgrade eap8-wildflyUpgrade eap8-wildfly-clustering-server-infinispanUpgrade eap8-resteasyUpgrade eap8-wildfly-clustering-server-jgroupsUpgrade eap8-jaxb-xjcUpgrade eap8-resteasy-coreUpgrade eap8-netty-codec-httpUpgrade eap8-wildfly-clustering-session-spec-spiUpgrade eap8-jsonb-specUpgrade eap8-netty-resolverUpgrade eap8-netty-transportUpgrade eap8-jackson-jaxrs-baseUpgrade eap8-log4jUpgrade eap8-resteasy-clientUpgrade eap8-relaxng-datatypeUpgrade eap8-jackson-datatype-jdk8Upgrade eap8-hal-consoleUpgrade eap8-wildfly-clusteringUpgrade eap8-jackson-modules-java8Upgrade eap8-wildfly-elytron-toolUpgrade eap8-resteasy-jsapiUpgrade eap8-jackson-dataformat-yamlUpgrade eap8-resteasy-json-binding-providerUpgrade eap8-wildfly-clustering-session-infinispan-remoteUpgrade eap8-netty-handler-proxyUpgrade eap8-apache-sshdUpgrade eap8-jackson-databindUpgrade eap8-netty-transport-native-unix-commonUpgrade eap8-jsf-implUpgrade eap8-resteasy-client-apiUpgrade eap8-wildfly-clustering-marshalling-protostreamUpgrade eap8-netty-codecUpgrade eap8-netty-bufferUpgrade eap8-wildfly-clustering-server-spiUpgrade eap8-wildfly-elytronUpgrade eap8-jackson-coreUpgrade eap8-netty-transport-classes-epollUpgrade eap8-wildfly-clustering-session-spiUpgrade eap8-rngomUpgrade eap8-apache-cxfUpgrade eap8-apache-cxf-servicesUpgrade eap8-resteasy-cryptoUpgrade eap8-netty-commonUpgrade eap8-jackson-jaxrs-json-providerUpgrade eap8-codemodelUpgrade eap8-wildfly-clustering-cache-infinispan-embeddedUpgrade eap8-netty-resolver-dnsUpgrade eap8-wildfly-clustering-server-apiUpgrade eap8-jaxb-coreUpgrade eap8-wildfly-java-jdk21Upgrade eap8-jackson-modules-baseUpgrade eap8-wildfly-clustering-contextUpgrade eap8-netty-transport-native-epollUpgrade eap8-jackson-module-jakarta-xmlbind-annotationsUpgrade eap8-netty-codec-socksUpgrade eap8-resteasy-multipart-providerUpgrade eap8-apache-cxf-toolsUpgrade eap8-xsomUpgrade eap8-eap-product-conf-parentUpgrade eap8-netty-handlerUpgrade eap8-apache-cxf-rtUpgrade eap8-resteasy-atom-providerUpgrade eap8-hibernate-coreUpgrade eap8-jaxb-runtime | Oct 30, 2026 | Aug 6, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub