CVE-2026-65583 in CXF
Summary
by MITRE • 08/06/2026
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability in Apache CXF's OpenID Connect relying-party implementation represents a significant authentication bypass risk that stems from inadequate validation of self-issued ID tokens. This flaw occurs within the token validation process where the system fails to enforce essential claim checks that are fundamental to secure authentication flows. The vulnerability specifically affects the validation logic that should verify issuer, subject, audience, time constraints, and subject public key binding parameters. When an attacker crafts a malicious ID token with these required claims omitted or manipulated, the system may incorrectly accept it as valid, thereby allowing unauthorized access to protected resources.
The technical root cause of this vulnerability lies in the insufficient enforcement of OpenID Connect specification requirements during token validation. According to the OpenID Connect Core 1.0 standard and associated security guidelines, ID tokens must contain specific claims including the issuer identifier, subject identifier, audience claim, and time-based validity constraints. The system's failure to properly validate these critical elements creates a pathway for attackers to craft tokens that bypass normal authentication mechanisms. This weakness aligns with CWE-287 which addresses improper authentication issues in software systems, particularly those involving token validation failures.
The operational impact of this vulnerability extends beyond simple unauthorized access, potentially enabling more sophisticated attacks such as privilege escalation or lateral movement within affected systems. Attackers could exploit this flaw to impersonate legitimate users and gain access to sensitive resources protected by the CXF-based OpenID Connect implementation. The risk is particularly elevated in environments where the relying party service handles authentication for multiple applications or services, as a successful exploitation could compromise an entire authentication ecosystem.
Security practitioners should note that this vulnerability affects specific versions of Apache CXF and is not present in all deployments. The default configuration of the validator does not accept self-issued ID tokens, which means organizations using the affected versions but with default settings may be less vulnerable. However, organizations that have explicitly configured their systems to accept self-issued tokens are at risk and must implement the recommended patches. The fix addresses the core validation logic by ensuring that all required claims are properly checked regardless of token type, aligning with ATT&CK technique T1566 which covers credential access through forged authentication tokens.
Organizations should prioritize upgrading their Apache CXF installations to versions 4.2.3, 4.1.8, or 3.6.12 as recommended by the vendor. The upgrade process should include thorough testing of all authentication flows to ensure that legitimate user access is not disrupted while the vulnerability is resolved. Additionally, security teams should review their current OpenID Connect configurations and verify that self-issued token acceptance is properly restricted in environments where this feature is not required for legitimate business operations. Network monitoring and logging should be enhanced to detect potential exploitation attempts involving malformed ID tokens or unusual authentication patterns that might indicate an attack against this vulnerability.