Every CVE Search/ Get API key

CVE-2026-57817

Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow

8.1 High

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the c_hash parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the c_hash, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.69%Up 0.2 points since Aug 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.1

Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the c_hash parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the c_hash, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Record
CVE-2026-57817
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2026-53855 8.1

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the c_hash parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the c_hash, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Record
EUVD-2026-53855
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-h8f8-97w2-2925 9.8

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash`...

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the c_hash parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the c_hash, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Record
GHSA-h8f8-97w2-2925
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
NVD 8.1

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the c_hash parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the c_hash, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Record
CVE-2026-57817
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 8.1

Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the c_hash parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the c_hash, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Record
CVE-2026-57817
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVRHLW-2026-2ceee64f37112e19 8.1

Lightwell Security Advisory: cxf-rt-rs-security-sso-oidc 3.6.9.rhlw-00002

Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-sso-oidc 3.6.9.rhlw-00002 with backported fixes for CVE-2026-57817 and CVE-2026-65583.

CVE-2026-57817: Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow

CVE-2026-65583: Apache CXF: Self-issued ID token claims validation skipped

This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-sso-oidc 3.6.9 from Maven Central.

Record
RHLW-2026-2ceee64f37112e19
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHLW-2026-c23e4577fae1d333 8.1

Lightwell Security Advisory: cxf-jaxrs-service 4.2.2.rhlw-00008

Red Hat Lightwell has released org.apache.cxf.archetype:cxf-jaxrs-service 4.2.2.rhlw-00008 with backported fixes for CVE-2026-57817 and CVE-2026-65583.

CVE-2026-57817: Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow

CVE-2026-65583: Apache CXF: Self-issued ID token claims validation skipped

This patched artifact is a drop-in replacement for org.apache.cxf.archetype:cxf-jaxrs-service 4.2.2 from Maven Central.

Record
RHLW-2026-c23e4577fae1d333
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHLW-2026-cf52dc28ccb66c72 8.1

Lightwell Security Advisory: cxf-rt-rs-security-sso-oidc 4.2.2.rhlw-00008

Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-sso-oidc 4.2.2.rhlw-00008 with backported fixes for CVE-2026-57817 and CVE-2026-65583.

CVE-2026-57817: Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow

CVE-2026-65583: Apache CXF: Self-issued ID token claims validation skipped

This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-sso-oidc 4.2.2 from Maven Central.

Record
RHLW-2026-cf52dc28ccb66c72
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.cxf:cxf-rt-rs-security-sso-oidc
Red Hat Lightwell:Maven
From an advisory covering 2 CVEs
 before 3.6.9.rhlw-00002, plus listed versions
3.0.103.0.113.0.123.0.133.0.14
Show 45 moreShow less
3.0.153.0.163.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.103.1.113.1.123.1.133.1.143.1.153.1.163.1.173.1.183.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.2.13.2.103.2.113.2.123.2.133.2.143.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.93.3.03.3.1
3.6.9.rhlw-00002
org.apache.cxf.archetype:cxf-jaxrs-service
Red Hat Lightwell:Maven
From an advisory covering 2 CVEs
 before 4.2.2.rhlw-00008, plus listed versions
2.5.12.5.102.5.112.5.22.5.3
Show 45 moreShow less
2.5.42.5.52.5.62.5.72.5.82.5.92.6.02.6.12.6.102.6.112.6.122.6.132.6.142.6.152.6.162.6.172.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.92.7.02.7.12.7.102.7.112.7.122.7.132.7.142.7.152.7.162.7.172.7.182.7.22.7.32.7.42.7.52.7.62.7.72.7.82.7.93.0.03.0.0-milestone1
4.2.2.rhlw-00008
org.apache.cxf:cxf-rt-rs-security-sso-oidc
Red Hat Lightwell:Maven
From an advisory covering 2 CVEs
 4.2.2 up to 4.2.2.rhlw-00008
4.2.2.rhlw-00008

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-57817 is a high vulnerability (CVSS 8.1) in Apache Cxf, published August 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. No source names a fixed version.

References

This page doesn't list everything

Left out here: 172 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open