PT-2026-108814 · Apache · Apache Cxf
CVE-2026-71575
·
Published
2026-10-09
·
Updated
2026-10-09
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Apache CXF versions prior to 4.2.4
Apache CXF versions prior to 4.1.9
Apache CXF versions prior to 3.6.13
Description
An issue exists in the
OidcClientCodeRequestFilter where the max age authentication-freshness check is inoperative. This is caused by a unit mismatch between milliseconds and seconds and an inverted comparison polarity. Consequently, any relying party using setMaxAgeOffset to enforce re-authentication will silently accept sessions regardless of their age, allowing the bypass of step-up authentication policies.Recommendations
Upgrade to version 4.2.4.
Upgrade to version 4.1.9.
Upgrade to version 3.6.13.
Insufficient Session Expiration
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Cxf