Executive brief
Apache CXF is a widely-used framework for building web services and REST APIs. The OAuth2 TokenIntrospectionService component contains an authentication bypass flaw that allows unauthenticated attackers to access the token introspection endpoint, which is used to validate OAuth tokens. An attacker could exploit this to inspect tokens and potentially forge authentication credentials, compromising the security of applications that rely on this service.
Technical details
The vulnerability is classified as improper authentication (CWE-287) affecting the OAuth2 TokenIntrospectionService in Apache CXF. The root cause is a missing 'throw' keyword in a security context check within the introspection endpoint (/services/oauth2/introspect), causing the authentication guard to fail silently rather than block unauthorized access. An unauthenticated network attacker can reach the endpoint without credentials and introspect OAuth tokens, potentially extracting token information or bypassing authentication mechanisms. This only exposes a vulnerability if administrators have failed to enable authentication on the service itself. The vulnerability affects Apache CXF versions 4.2.0 through 4.2.1 and all versions before 4.1.7; patches are available in versions 4.2.2 and 4.1.7.
Affected products
- Apache CXF 4.2.0 through 4.2.1, and versions before 4.1.7
Timeline
- 2026-06-12: disclosed: CVE-2026-50623 published and GHSA advisory released
- 2026-06-12: patched: Patches released in CXF 4.2.2 and 4.1.7