CVE-2026-63687 in CXF
Summary
by MITRE • 08/06/2026
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known or compromised) can thereby substitute the code_challenge, code_challenge_method, nonce, and state values that were set in the outer HTTP request, undermining PKCE integrity and OpenID Connect replay protection. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability in Apache CXF's JwtRequestCodeFilter represents a critical security flaw that undermines the integrity of OAuth 2.0 and OpenID Connect authentication flows. This issue stems from improper handling of JWT claims during the authorization code flow processing, where the system fails to distinguish between legitimate user data and security-sensitive parameters that should remain protected. The flaw exists in how the filter processes signed JWT tokens, specifically by blindly copying all claims into the authorization parameter map without adequate sanitization or filtering mechanisms. This behavior creates a significant attack vector where malicious actors can manipulate critical authentication parameters that are essential for maintaining session security and preventing replay attacks.
The technical implementation of this vulnerability allows attackers who possess a validly-signed JWT token to override crucial PKCE (Proof Key for Code Exchange) parameters including code_challenge, code_challenge_method, nonce, and state values. These parameters serve distinct security purposes within the OAuth 2.0 framework where code_challenge and code_challenge_method protect against authorization code interception attacks, nonce prevents replay attacks in OpenID Connect contexts, and state maintains session integrity across authentication flows. When these values are overwritten through the JWT claims copying mechanism, the entire security model of the authentication flow becomes compromised, effectively nullifying the protections that PKCE and OpenID Connect were designed to provide.
The operational impact of this vulnerability extends beyond simple credential theft or unauthorized access attempts, as it fundamentally weakens the core security assurances that OAuth 2.0 and OpenID Connect protocols are meant to deliver. Attackers can exploit this weakness to bypass security controls that prevent man-in-the-middle attacks, session replay scenarios, and other authentication-related threats. The vulnerability particularly affects systems that rely on JWT-based authentication flows where client secrets may be compromised or where attackers have gained access to valid JWT tokens through various means such as network interception, insider threats, or credential leakage events. This weakness becomes especially dangerous in environments where sensitive data access is controlled through these authentication mechanisms.
This vulnerability aligns with CWE-200 (Information Exposure) and CWE-345 (Insufficient Verification of Data Authenticity) categories, as it exposes security-critical parameters and fails to properly validate parameter integrity. From an ATT&CK framework perspective, this represents a privilege escalation vector through credential access and defense evasion techniques, potentially enabling attackers to bypass authentication controls that would normally prevent unauthorized system access. The recommended mitigation involves upgrading to Apache CXF versions 4.2.3, 4.1.8, or 3.6.12, which implement proper claim filtering mechanisms that exclude security-sensitive parameters from being overwritten by JWT claims. Organizations should also consider implementing additional monitoring for unusual parameter changes in authentication flows and conduct thorough security assessments of their OAuth 2.0 implementations to identify similar vulnerabilities across their technology stack.