CVE-2026-50623
Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Record
CVE-2026-50623- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2026-36393
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Record
EUVD-2026-36393- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-542g-m3fx-q86f
Apache CXF has Authentication Bypass in OAuth2 TokenIntrospectionService
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7, which fixes this issue.
- Record
GHSA-542g-m3fx-q86f- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Record
CVE-2026-50623- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-05
OSV
Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Record
CVE-2026-50623- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-07
OSVGHSA-542g-m3fx-q86f
Apache CXF has Authentication Bypass in OAuth2 TokenIntrospectionService
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7, which fixes this issue.
- Record
GHSA-542g-m3fx-q86f- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
Show 4 moreShow less
OSVRHLW-2026-fd244c7ea4e4e9e4
Lightwell Security Advisory: cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003
Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003 with backported fixes for CVE-2026-50623, CVE-2026-50627, CVE-2026-50628, CVE-2026-50629, CVE-2026-50630, CVE-2026-50631, CVE-2026-57818, CVE-2026-61466, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481.
CVE-2026-50623: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
CVE-2026-50627: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator
CVE-2026-50628: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
CVE-2026-50629: Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier
CVE-2026-50630: Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection
CVE-2026-50631: Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing
CVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider
CVE-2026-61466: Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation
CVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters
CVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
CVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider
This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9 from Maven Central.
- Record
RHLW-2026-fd244c7ea4e4e9e4- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1787867443 No score
TuxCare security update for org.apache.cxf (4 CVEs)
TuxCare rebuilt 4 org.apache.cxf packages to address 4 CVEs. Fixed in 3.5.9-tuxcare.7.
- Record
CLSA-2026-1787867443- Updated
- 2026-11-02
OSVCLSA-2026-1788474736 No score
TuxCare security update for org.apache.cxf (5 CVEs)
TuxCare rebuilt 4 org.apache.cxf packages to address 5 CVEs. Fixed in 3.5.11-tuxcare.9.
- Record
CLSA-2026-1788474736- Updated
- 2026-11-02
OSVCLSA-2026-1794008495 No score
TuxCare security update for 8 packages (12 CVEs)
TuxCare rebuilt 8 packages to address 12 CVEs. Fixed in 3.4.5-tuxcare.2.
- Record
CLSA-2026-1794008495- Updated
- 2026-11-07
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-rt-rs-security-oauth2Maven |
4.2.0 up to 4.2.2 | 4.2.2 |
org.apache.cxf:cxf-rt-rs-security-oauth2Maven |
before 4.1.7 | 4.1.7 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 4 CVEs |
3.5.9 up to 3.5.9-tuxcare.7, plus listed versions 3.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.43.5.9-tuxcare.53.5.9-tuxcare.63.5.9.tuxcare.1 |
3.5.9-tuxcare.7 |
org.apache.cxf:cxf-integration-jcaTuxCare:Maven From an advisory covering 4 CVEs |
3.5.9 up to 3.5.9-tuxcare.7, plus listed versions 3.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.43.5.9-tuxcare.53.5.9-tuxcare.63.5.9.tuxcare.1 |
3.5.9-tuxcare.7 |
org.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCare:Maven From an advisory covering 4 CVEs |
3.5.9 up to 3.5.9-tuxcare.7, plus listed versions 3.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.43.5.9-tuxcare.53.5.9-tuxcare.63.5.9.tuxcare.1 |
3.5.9-tuxcare.7 |
org.apache.cxf:cxf-rt-rs-security-oauth2TuxCare:Maven From an advisory covering 4 CVEs |
3.5.9 up to 3.5.9-tuxcare.7, plus listed versions 3.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.43.5.9-tuxcare.53.5.9-tuxcare.63.5.9.tuxcare.1 |
3.5.9-tuxcare.7 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 5 CVEs |
3.5.11 up to 3.5.11-tuxcare.9, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.43.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.8 |
3.5.11-tuxcare.9 |
org.apache.cxf:cxf-integration-jcaTuxCare:Maven From an advisory covering 5 CVEs |
3.5.11 up to 3.5.11-tuxcare.9, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.43.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.8 |
3.5.11-tuxcare.9 |
org.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCare:Maven From an advisory covering 5 CVEs |
3.5.11 up to 3.5.11-tuxcare.9, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.43.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.8 |
3.5.11-tuxcare.9 |
org.apache.cxf:cxf-rt-rs-security-oauth2TuxCare:Maven From an advisory covering 5 CVEs |
3.5.11 up to 3.5.11-tuxcare.9, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.43.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.8 |
3.5.11-tuxcare.9 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldapTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-integration-jcaTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-frontend-jaxrsTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-rs-security-oauth2TuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-transports-jmsTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-wsdlTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-rs-security-oauth2Maven |
4.2.0 up to 4.2.2, plus listed versions 4.2.1 |
4.2.2 |
org.apache.cxf:cxf-rt-rs-security-oauth2Maven |
before 4.1.7, plus listed versions 2.6.02.6.12.6.102.6.112.6.12 Show 45 moreShow less2.6.132.6.142.6.152.6.162.6.172.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.92.7.02.7.12.7.102.7.112.7.122.7.132.7.142.7.152.7.162.7.172.7.182.7.22.7.32.7.42.7.52.7.62.7.72.7.82.7.93.0.03.0.0-milestone13.0.0-milestone23.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.163.0.23.0.3 |
4.1.7 |
org.apache.cxf:cxf-rt-rs-security-oauth2Red Hat Lightwell:Maven From an advisory covering 11 CVEs |
before 3.6.9.rhlw-00003, plus listed versions 2.6.02.6.12.6.102.6.112.6.12 Show 45 moreShow less2.6.132.6.142.6.152.6.162.6.172.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.92.7.02.7.12.7.102.7.112.7.122.7.132.7.142.7.152.7.162.7.172.7.182.7.22.7.32.7.42.7.52.7.62.7.72.7.82.7.93.0.03.0.0-milestone13.0.0-milestone23.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.163.0.23.0.3 |
3.6.9.rhlw-00003 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected | ||
| facts | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-50623 is a medium vulnerability (CVSS 4.8) in Apache Cxf, published June 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in org.apache.cxf:cxf-rt-rs-security-oauth2 4.2.2.
References
lists.apache.org/thread/ydzj8m5mqmjy13xgyj9mkk9hfff63qq7
openwall.com/lists/oss-security/2026/06/11/3
nvd.nist.gov/vuln/detail/CVE-2026-50623
github.com/advisories/GHSA-542g-m3fx-q86f
repo.maven.apache.org/maven2
Show 41 moreShow less
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50627.json
access.redhat.com/errata/RHSA-2026:37390
Left out here: 196 versions. The JSON record has them.