Apache CXF up to 3.6.11/4.1.7/4.2.2 JwtRequestCodeFilter nonce improper authentication

Summaryinfo

A vulnerability classified as critical was found in Apache CXF up to 3.6.11/4.1.7/4.2.2. This vulnerability affects the function JwtRequestCodeFilter. Executing a manipulation of the argument nonce can lead to improper authentication. The identification of this vulnerability is CVE-2026-63687. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in Apache CXF up to 3.6.11/4.1.7/4.2.2 and classified as critical. This vulnerability affects the function JwtRequestCodeFilter. The manipulation of the argument nonce with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known or compromised) can thereby substitute the code_challenge, code_challenge_method, nonce, and state values that were set in the outer HTTP request, undermining PKCE integrity and OpenID Connect replay protection. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

The advisory is available at lists.apache.org. This vulnerability was named CVE-2026-63687 since 07/17/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 08/06/2026).

Upgrading to version 3.6.12, 4.1.8 or 4.2.3 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• CXF

Version

• 3.6.0
• 3.6.1
• 3.6.2
• 3.6.3
• 3.6.4
• 3.6.5
• 3.6.6
• 3.6.7
• 3.6.8
• 3.6.9
• 3.6.10
• 3.6.11
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6
• 4.1.7
• 4.2.0
• 4.2.1
• 4.2.2

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion