PT-2026-80263

Published

2026-06-12

·

Updated

2026-06-12

Description by

CVSS 3.1
9.1
Critical
MetricsAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
Exploitability
Fix
Vendors
Affected products
Weakness enumeration
CWE-303: Incorrect Implementation of Authentication Algorithm
CWE-289: Authentication Bypass by Alternate Name
Related identifiers
GHSA-9MRV-8PVF-HF4M
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com