CVE-2026-68481

EUVD-2026-53857

06.08.2026, 12:16

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and 'introspection of a revoked token MUST return {"active":false}'. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Affected Products (NVD)

Vendor	Product	Version
apache	cxf	𝑥 < 3.6.12
apache	cxf	4.0.0 ≤ 𝑥 < 4.1.8
apache	cxf	4.2.0 ≤ 𝑥 < 4.2.3

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-672 - Operation on a Resource after Expiration or Release
The software uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

References

https://lists.apache.org/thread/88c0h10yjb2b8201o1km3st71fs2zw2b