CVE-2026-65583

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.3 Apache CXF versions prior to 4.1.8 Apache CXF versions prior to 3.6.12

Description OIDC relying-party token validation may accept self-issued ID tokens without enforcing necessary claim checks, including issuer, subject, audience, time, and sub jwk binding. This flaw allows for authentication bypass using crafted tokens, although self-issued ID tokens are not accepted by default in the validator.

Recommendations Upgrade to version 4.2.3. Upgrade to version 4.1.8. Upgrade to version 3.6.12.