Every CVE Search/ Get API key

CVE-2026-65583

Apache CXF: Self-issued ID token claims validation skipped

9.1 Critical

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.28%Unchanged since Aug 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.1

Apache CXF: Self-issued ID token claims validation skipped

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.

Record
CVE-2026-65583
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-345
Updated
2026-11-02
EUVDEUVD-2026-53859 9.1

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.

Record
EUVD-2026-53859
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-9rwm-8rh4-8q53 9.1

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without...

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.

Record
GHSA-9rwm-8rh4-8q53
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-345
Updated
2026-11-02
NVD 9.1

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.

Record
CVE-2026-65583
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-345
Updated
2026-11-02
OSV 9.1

Apache CXF: Self-issued ID token claims validation skipped

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.

Record
CVE-2026-65583
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-345
Updated
2026-11-02
OSVRHLW-2026-2ceee64f37112e19 8.1

Lightwell Security Advisory: cxf-rt-rs-security-sso-oidc 3.6.9.rhlw-00002

Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-sso-oidc 3.6.9.rhlw-00002 with backported fixes for CVE-2026-57817 and CVE-2026-65583.

CVE-2026-57817: Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow

CVE-2026-65583: Apache CXF: Self-issued ID token claims validation skipped

This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-sso-oidc 3.6.9 from Maven Central.

Record
RHLW-2026-2ceee64f37112e19
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHLW-2026-c23e4577fae1d333 8.1

Lightwell Security Advisory: cxf-jaxrs-service 4.2.2.rhlw-00008

Red Hat Lightwell has released org.apache.cxf.archetype:cxf-jaxrs-service 4.2.2.rhlw-00008 with backported fixes for CVE-2026-57817 and CVE-2026-65583.

CVE-2026-57817: Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow

CVE-2026-65583: Apache CXF: Self-issued ID token claims validation skipped

This patched artifact is a drop-in replacement for org.apache.cxf.archetype:cxf-jaxrs-service 4.2.2 from Maven Central.

Record
RHLW-2026-c23e4577fae1d333
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHLW-2026-cf52dc28ccb66c72 8.1

Lightwell Security Advisory: cxf-rt-rs-security-sso-oidc 4.2.2.rhlw-00008

Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-sso-oidc 4.2.2.rhlw-00008 with backported fixes for CVE-2026-57817 and CVE-2026-65583.

CVE-2026-57817: Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow

CVE-2026-65583: Apache CXF: Self-issued ID token claims validation skipped

This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-sso-oidc 4.2.2 from Maven Central.

Record
RHLW-2026-cf52dc28ccb66c72
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.cxf:cxf-rt-rs-security-sso-oidc
Red Hat Lightwell:Maven
From an advisory covering 2 CVEs
 before 3.6.9.rhlw-00002, plus listed versions
3.0.103.0.113.0.123.0.133.0.14
Show 45 moreShow less
3.0.153.0.163.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.103.1.113.1.123.1.133.1.143.1.153.1.163.1.173.1.183.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.2.13.2.103.2.113.2.123.2.133.2.143.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.93.3.03.3.1
3.6.9.rhlw-00002
org.apache.cxf.archetype:cxf-jaxrs-service
Red Hat Lightwell:Maven
From an advisory covering 2 CVEs
 before 4.2.2.rhlw-00008, plus listed versions
2.5.12.5.102.5.112.5.22.5.3
Show 45 moreShow less
2.5.42.5.52.5.62.5.72.5.82.5.92.6.02.6.12.6.102.6.112.6.122.6.132.6.142.6.152.6.162.6.172.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.92.7.02.7.12.7.102.7.112.7.122.7.132.7.142.7.152.7.162.7.172.7.182.7.22.7.32.7.42.7.52.7.62.7.72.7.82.7.93.0.03.0.0-milestone1
4.2.2.rhlw-00008
org.apache.cxf:cxf-rt-rs-security-sso-oidc
Red Hat Lightwell:Maven
From an advisory covering 2 CVEs
 4.2.2 up to 4.2.2.rhlw-00008
4.2.2.rhlw-00008

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-65583 is a critical vulnerability (CVSS 9.1) in Apache Cxf, published August 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. No source names a fixed version.

References

This page doesn't list everything

Left out here: 172 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open