CVE-2026-65583
Apache CXF: Self-issued ID token claims validation skipped
9.1 Critical
CVE-2026-65583 is a critical vulnerability (CVSS 9.1) in Apache Cxf, published August 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. No source names a fixed version.
- Severity
- 9.1 CriticalCVSS 3.1, CVE List
- Exploit chance
- 0.28%EPSS, 20th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
0.28%Unchanged since Aug 7, 2026
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-rt-rs-security-sso-oidcRed Hat Lightwell:Maven From an advisory covering 2 CVEs | before 3.6.9.rhlw-00002, plus listed versions 3.0.103.0.113.0.123.0.133.0.14 Show 45 moreShow less3.0.153.0.163.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.103.1.113.1.123.1.133.1.143.1.153.1.163.1.173.1.183.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.2.13.2.103.2.113.2.123.2.133.2.143.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.93.3.03.3.1 | 3.6.9.rhlw-00002 |
org.apache.cxf.archetype:cxf-jaxrs-serviceRed Hat Lightwell:Maven From an advisory covering 2 CVEs | before 4.2.2.rhlw-00008, plus listed versions 2.5.12.5.102.5.112.5.22.5.3 Show 45 moreShow less2.5.42.5.52.5.62.5.72.5.82.5.92.6.02.6.12.6.102.6.112.6.122.6.132.6.142.6.152.6.162.6.172.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.92.7.02.7.12.7.102.7.112.7.122.7.132.7.142.7.152.7.162.7.172.7.182.7.22.7.32.7.42.7.52.7.62.7.72.7.82.7.93.0.03.0.0-milestone1 | 4.2.2.rhlw-00008 |
org.apache.cxf:cxf-rt-rs-security-sso-oidcRed Hat Lightwell:Maven From an advisory covering 2 CVEs | 4.2.2 up to 4.2.2.rhlw-00008 | 4.2.2.rhlw-00008 |
eap8-apache-cxfRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el9eap | 0:4.1.8-1.redhat_00001.1.el9eap |
eap8-apache-cxf-rtRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el9eap | 0:4.1.8-1.redhat_00001.1.el9eap |
eap8-apache-cxf-servicesRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el9eap | 0:4.1.8-1.redhat_00001.1.el9eap |
eap8-apache-cxf-toolsRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el9eap | 0:4.1.8-1.redhat_00001.1.el9eap |
eap8-nettyRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-bufferRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-codecRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
Show 102 moreShow less
| Package | Affected | Fixed |
|---|---|---|
eap8-netty-codec-dnsRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-codec-httpRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-codec-socksRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-commonRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-handlerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-handler-proxyRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-resolverRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-resolver-dnsRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-transportRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-transport-classes-epollRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-transport-native-epollRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-transport-native-epoll-debuginfoRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-transport-native-unix-commonRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-resteasyRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-atom-providerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-cdiRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-clientRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-client-apiRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-coreRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-core-spiRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-cryptoRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-jackson2-providerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-jaxb-providerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-jsapiRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-json-binding-providerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-json-p-providerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-multipart-providerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-rxjava2Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-validator-providerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-apache-cxfRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el8eap | 0:4.1.8-1.redhat_00001.1.el8eap |
eap8-apache-cxf-rtRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el8eap | 0:4.1.8-1.redhat_00001.1.el8eap |
eap8-apache-cxf-servicesRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el8eap | 0:4.1.8-1.redhat_00001.1.el8eap |
eap8-apache-cxf-toolsRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el8eap | 0:4.1.8-1.redhat_00001.1.el8eap |
eap8-apache-sshdRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:2.19.0-1.redhat_00001.1.el8eap | 0:2.19.0-1.redhat_00001.1.el8eap |
eap8-nettyRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-bufferRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-codecRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-codec-dnsRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-codec-httpRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-codec-socksRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-commonRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-handlerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-handler-proxyRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-resolverRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-resolver-dnsRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-transportRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-transport-classes-epollRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-transport-native-epollRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-transport-native-epoll-debuginfoRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-transport-native-unix-commonRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-resteasyRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-atom-providerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-cdiRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-clientRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-client-apiRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-coreRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-core-spiRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-cryptoRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-jackson2-providerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-jaxb-providerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-jsapiRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-json-binding-providerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-json-p-providerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-multipart-providerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-rxjava2Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-validator-providerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-apache-cxfRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el10eap | 0:4.1.8-1.redhat_00001.1.el10eap |
eap8-apache-cxf-rtRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el10eap | 0:4.1.8-1.redhat_00001.1.el10eap |
eap8-apache-cxf-servicesRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el10eap | 0:4.1.8-1.redhat_00001.1.el10eap |
eap8-apache-cxf-toolsRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el10eap | 0:4.1.8-1.redhat_00001.1.el10eap |
eap8-nettyRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-bufferRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-codecRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-codec-dnsRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-codec-httpRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-codec-socksRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-commonRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-handlerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-handler-proxyRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-resolverRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-resolver-dnsRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-transportRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-transport-classes-epollRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-transport-native-epollRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-transport-native-epoll-debuginfoRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-transport-native-unix-commonRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-resteasyRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-atom-providerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-cdiRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-clientRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-client-apiRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-coreRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-core-spiRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-cryptoRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-jackson2-providerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-jaxb-providerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-jsapiRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-json-binding-providerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-json-p-providerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-multipart-providerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-rxjava2Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-validator-providerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
What each source reports
CVE List Score used
Apache CXF: Self-issued ID token claims validation skipped
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.
- Record
CVE-2026-65583- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-345
- Updated
- 2026-11-02
EUVDEUVD-2026-53859
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.
- Record
EUVD-2026-53859- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9rwm-8rh4-8q53
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without...
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.
- Record
GHSA-9rwm-8rh4-8q53- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-345
- Updated
- 2026-11-02
NVD
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.
- Record
CVE-2026-65583- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-345
- Updated
- 2026-11-02
OSV
Apache CXF: Self-issued ID token claims validation skipped
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.
- Record
CVE-2026-65583- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-345
- Updated
- 2026-11-02
OSVRHLW-2026-2ceee64f37112e19
Lightwell Security Advisory: cxf-rt-rs-security-sso-oidc 3.6.9.rhlw-00002
Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-sso-oidc 3.6.9.rhlw-00002 with backported fixes for CVE-2026-57817 and CVE-2026-65583.
CVE-2026-57817: Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow
CVE-2026-65583: Apache CXF: Self-issued ID token claims validation skipped
This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-sso-oidc 3.6.9 from Maven Central.
- Record
RHLW-2026-2ceee64f37112e19- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVRHLW-2026-c23e4577fae1d333
Lightwell Security Advisory: cxf-jaxrs-service 4.2.2.rhlw-00008
Red Hat Lightwell has released org.apache.cxf.archetype:cxf-jaxrs-service 4.2.2.rhlw-00008 with backported fixes for CVE-2026-57817 and CVE-2026-65583.
CVE-2026-57817: Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow
CVE-2026-65583: Apache CXF: Self-issued ID token claims validation skipped
This patched artifact is a drop-in replacement for org.apache.cxf.archetype:cxf-jaxrs-service 4.2.2 from Maven Central.
- Record
RHLW-2026-c23e4577fae1d333- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHLW-2026-cf52dc28ccb66c72
Lightwell Security Advisory: cxf-rt-rs-security-sso-oidc 4.2.2.rhlw-00008
Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-sso-oidc 4.2.2.rhlw-00008 with backported fixes for CVE-2026-57817 and CVE-2026-65583.
CVE-2026-57817: Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow
CVE-2026-65583: Apache CXF: Self-issued ID token claims validation skipped
This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-rs-security-sso-oidc 4.2.2 from Maven Central.
- Record
RHLW-2026-cf52dc28ccb66c72- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:92056
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update
- Record
RHSA-2026:92056- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-13
OSVRHSA-2026:92057
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update
- Record
RHSA-2026:92057- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-13
OSVRHSA-2026:92059
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update
- Record
RHSA-2026:92059- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-13
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.apache.org/thread/fzj8yzgfl53gclxrcdrnrx3grcpkq51j
openwall.com/lists/oss-security/2026/08/06/23
nvd.nist.gov/vuln/detail/CVE-2026-65583
github.com/advisories/GHSA-9rwm-8rh4-8q53
repo.maven.apache.org/maven2
Show 47 moreShow less
access.redhat.com/errata/RHSA-2026:92056
docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1
bugzilla.redhat.com/show_bug.cgi?id=2511978
issues.redhat.com/browse/JBEAP-34960
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92056.json
cve.org/CVERecord?id=CVE-2026-57819
This page doesn't list everything
Left out here: 172 versions. The JSON record has them.