CVE-2026-57817

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.3 Apache CXF versions prior to 4.1.8 Apache CXF versions prior to 3.6.12

Description When operating in the Hybrid Flow, the Relying Party (RP) fails to mandate the validation of the c hash parameter. If the RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits this parameter, it allows for Authorization Code Substitution or Injection attacks.

Recommendations Upgrade to version 4.2.3. Upgrade to version 4.1.8. Upgrade to version 3.6.12.