CVE-2025-66621
Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.
This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.
We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.
Exploit likelihood
What each source reports
CVE List No score
Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.
This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.
We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.
- Record
CVE-2025-66621- Weakness
- CWE-345
- Updated
- 2026-11-06
EUVDEUVD-2025-211271 No score
Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.
This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.
We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.
- Record
EUVD-2025-211271- Updated
- 2026-11-06
GitHub AdvisoriesGHSA-rg6c-rqpp-49q4 No score
Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim...
Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.
This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.
We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.
- Record
GHSA-rg6c-rqpp-49q4- Weakness
- CWE-345
- Updated
- 2026-11-06
NVD No score
Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.
This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.
We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.
- Record
CVE-2025-66621- Weakness
- CWE-345
- Updated
- 2026-11-06
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| references | CVE List, EUVD | |
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, published | EUVD | |
| aliases, references | GitHub Advisories | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-66621 is a vulnerability with no CVSS score yet in Apache Software Foundation James, published November 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. No source names a fixed version.