CVE-2026-50627

EUVD-2026-36395
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
apacheCNA
UNKNOWN
---
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
apachecxf
4.2.0 ≤
𝑥
< 4.2.2
CNA
apachecxf
𝑥
< 4.1.7
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://lists.apache.org/thread/0jfzz9q992957b99tw7hodcqjfyxwb1m
http://www.openwall.com/lists/oss-security/2026/06/11/4