CVE-2026-50627
June 12, 2026, 10:16 a.m.
None
No Score
Description
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
Product(s) Impacted
| Vendor | Product | Versions |
|---|---|---|
| Apache |
|
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-289
Authentication Bypass by Alternate Name
The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
*CPE(s)
Affected systems and software identified for this CVE.
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| a | apache | cxf | 4.2.2 | / | / | / | / | / | / | / |
| a | apache | cxf | 4.1.7 | / | / | / | / | / | / | / |
Tags
Timeline
Published: June 12, 2026, 10:16 a.m.
Last Modified: June 12, 2026, 10:16 a.m.
Last Modified: June 12, 2026, 10:16 a.m.
Status : Received
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.