CVE-2026-63687

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.3 Apache CXF versions prior to 4.1.8 Apache CXF versions prior to 3.6.12

Description The JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client capable of producing a validly-signed request JWT can substitute the code challenge, code challenge method, nonce, and state values established in the outer HTTP request. This action undermines PKCE (Proof Key for Code Exchange), a mechanism to prevent authorization code interception, and OpenID Connect replay protection.

Recommendations Upgrade to version 4.2.3 Upgrade to version 4.1.8 Upgrade to version 3.6.12