CVE-2026-50623: Apache CXF authentication bypass in OAuth2 TokenIntrospectionService

CVE-2026-50623 · Severity: medium · CVSS 6.5 · Published 2026-06-12

Apache CXF is a widely-used framework for building web services and REST APIs. The OAuth2 TokenIntrospectionService component contains an authentication bypass flaw that allows unauthenticated attackers to access the token introspection endpoint, which is used to validate OAuth tokens. An attacker could exploit this to inspect tokens and potentially forge authentication credentials, compromising the security of applications that rely on this service.

Technologies: Apache Software Foundation CXF, org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-50623 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50623 being exploited in the wild.
How severe is CVE-2026-50623?
Medium severity, with a CVSS score of 6.5, published 12 June 2026.
Which products and versions are affected?
Apache Software Foundation CXF 4.2.0 to 4.2.1, all versions before 4.1.7; org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven) ECOSYSTEM:introduced=4.2.0,fixed=4.2.2.
Is there a fix for CVE-2026-50623?
Yes. org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven): upgrade to 4.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50623 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50623?
Check whether you run Apache Software Foundation CXF or org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven): upgrade to 4.2.2 or later
    # set org.apache.cxf:cxf-rt-rs-security-oauth2 to 4.2.2 in your pom.xml or build.gradle

Technical details

The vulnerability is classified as improper authentication (CWE-287) affecting the OAuth2 TokenIntrospectionService in Apache CXF. The root cause is a missing 'throw' keyword in a security context check within the introspection endpoint (/services/oauth2/introspect), causing the authentication guard to fail silently rather than block unauthorized access. An unauthenticated network attacker can reach the endpoint without credentials and introspect OAuth tokens, potentially extracting token information or bypassing authentication mechanisms. This only exposes a vulnerability if administrators have failed to enable authentication on the service itself. The vulnerability affects Apache CXF versions 4.2.0 through 4.2.1 and all versions before 4.1.7; patches are available in versions 4.2.2 and 4.1.7.

Affected products

  • Apache CXF 4.2.0 through 4.2.1, and versions before 4.1.7

Identifiers

  • CVE-2026-50623
  • GHSA-542g-m3fx-q86f

Timeline

  • 2026-06-12: disclosed: CVE-2026-50623 published and GHSA advisory released
  • 2026-06-12: patched: Patches released in CXF 4.2.2 and 4.1.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.