CVE-2026-61466

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.3 Apache CXF versions prior to 4.1.8 Apache CXF versions prior to 3.6.12

Description In the OAuth2 Dynamic Client Registration endpoint, the authorization server stores the scope value from the client registration request without validating it against a predefined allowlist. This allows a client to self-assign privileged scopes during the registration process.

Recommendations Upgrade to version 4.2.3. Upgrade to version 4.1.8. Upgrade to version 3.6.12.