CVE-2026-50623

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.2 Apache CXF versions prior to 4.1.7 Apache CXF versions prior to 3.6.12

Description An authentication bypass exists in the OAuth2 TokenIntrospectionService. Due to a missing 'throw' keyword during the security context check, the endpoint '/services/oauth2/introspect' can be accessed by unauthenticated network attackers. This issue primarily affects environments where authentication was not explicitly enabled for the service.

Recommendations Upgrade to version 4.2.2. Upgrade to version 4.1.7. Upgrade to version 3.6.12.