Executive brief
Apache CXF is an open-source web services framework used by many enterprise applications to implement OAuth2 authentication and API security. A flaw in its JWT token validator allows an attacker with a valid access token (issued for one service) to reuse that token against a completely different service, bypassing authentication controls. This could lead to unauthorized data access, system compromise, or lateral movement within an organization relying on Apache CXF for security.
Technical details
The vulnerability is a missing validation flaw in the JwtAccessTokenValidator class in Apache CXF's OAuth2 security module (org.apache.cxf:cxf-rt-rs-security-oauth2). The validator fails to check the 'aud' (audience) claim in incoming JWT access tokens, which is intended to bind a token to a specific resource server. An attacker who possesses a valid JWT issued by a trusted authorization server for one resource server can submit that same JWT to a different resource server protected by the same CXF instance. Because audience validation is absent, the second server will accept the token, leading to a token confusion/routing attack. This requires the attacker to already possess a valid JWT (authentication required, high privilege), but once obtained, allows full read/write operations across trust boundaries. Patched versions 4.2.2 and 4.1.7 restore proper audience claim validation.
Affected products
- Apache CXF 4.2.0 to 4.2.1, < 4.1.7
Timeline
- 2026-06-12: disclosed
- 2026-06-12: patched: Patches released for versions 4.2.2 and 4.1.7