CVE-2026-50627: Apache CXF missing JWT Audience validation in JwtAccessTokenValidator

CVE-2026-50627 · Severity: critical · CVSS 9.1 · Published 2026-06-12

Apache CXF is an open-source web services framework used by many enterprise applications to implement OAuth2 authentication and API security. A flaw in its JWT token validator allows an attacker with a valid access token (issued for one service) to reuse that token against a completely different service, bypassing authentication controls. This could lead to unauthorized data access, system compromise, or lateral movement within an organization relying on Apache CXF for security.

Technologies: Apache Software Foundation CXF, org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-50627 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50627 being exploited in the wild.
How severe is CVE-2026-50627?
Critical severity, with a CVSS score of 9.1, published 12 June 2026.
Which products and versions are affected?
Apache Software Foundation CXF 4.2.0 to 4.2.1, all versions before 4.1.7; org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven) ECOSYSTEM:introduced=4.2.0,fixed=4.2.2.
Is there a fix for CVE-2026-50627?
Yes. org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven): upgrade to 4.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50627 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50627?
Check whether you run Apache Software Foundation CXF or org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven): upgrade to 4.2.2 or later
    # set org.apache.cxf:cxf-rt-rs-security-oauth2 to 4.2.2 in your pom.xml or build.gradle

Technical details

The vulnerability is a missing validation flaw in the JwtAccessTokenValidator class in Apache CXF's OAuth2 security module (org.apache.cxf:cxf-rt-rs-security-oauth2). The validator fails to check the 'aud' (audience) claim in incoming JWT access tokens, which is intended to bind a token to a specific resource server. An attacker who possesses a valid JWT issued by a trusted authorization server for one resource server can submit that same JWT to a different resource server protected by the same CXF instance. Because audience validation is absent, the second server will accept the token, leading to a token confusion/routing attack. This requires the attacker to already possess a valid JWT (authentication required, high privilege), but once obtained, allows full read/write operations across trust boundaries. Patched versions 4.2.2 and 4.1.7 restore proper audience claim validation.

Affected products

  • Apache CXF 4.2.0 to 4.2.1, < 4.1.7

Identifiers

  • CVE-2026-50627
  • GHSA-9mrv-8pvf-hf4m

Timeline

  • 2026-06-12: disclosed
  • 2026-06-12: patched: Patches released for versions 4.2.2 and 4.1.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.