PT-2026-48846

CVE-2026-50627

Published

2026-06-12

Updated

2026-11-03

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.2 Apache CXF versions prior to 4.1.7

Description The JwtAccessTokenValidator class fails to validate the aud (Audience) claims of incoming JWT access tokens. This flaw enables a JWT issued for one Resource Server to be replayed against a different Resource Server, resulting in Token Confusion or Routing attacks.

Recommendations Upgrade to version 4.2.2. Upgrade to version 4.1.7.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-289: Authentication Bypass by Alternate Name

CWE-303: Incorrect Implementation of Authentication Algorithm

Related identifiers