CVE-2025-66621

EUVD-2025-211271
Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.

This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.

We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
apacheCNA
UNKNOWN
---
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
apachejames
3.9.0 ≤
𝑥
< 3.9.1
CNA
Common Weakness Enumeration
References
https://lists.apache.org/thread.html/xz1g0blzcbxod69oktyq84h7t06xzov6
http://www.openwall.com/lists/oss-security/2026/11/06/13