https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 15:17:36 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349188 EUVD-2026-349188 https://cve.radiocsirt.org/vuln/euvd-2026-349188 https://cve.radiocsirt.org/vuln/fkie_cve-2026-68481 <p>In Apache CXF&#39;s DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that &#39;The authorization server MUST invalidate the token.&#39; and &#39;introspection of a revoked token MUST return {&#34;active&#34;:false}&#39;. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.</p> <p>In Apache CXF&#39;s DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that &#39;The authorization server MUST invalidate the token.&#39; and &#39;introspection of a revoked token MUST return {&#34;active&#34;:false}&#39;. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-68481 https://cve.radiocsirt.org/vuln/ghsa-5c8v-93q6-cjxj <p>In Apache CXF&#39;s DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that &#39;The authorization server MUST invalidate the token.&#39; and &#39;introspection of a revoked token MUST return {&#34;active&#34;:false}&#39;. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.</p> <p>In Apache CXF&#39;s DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that &#39;The authorization server MUST invalidate the token.&#39; and &#39;introspection of a revoked token MUST return {&#34;active&#34;:false}&#39;. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.</p> https://cve.radiocsirt.org/vuln/ghsa-5c8v-93q6-cjxj https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2682 <p>Ein Angreifer kann mehrere Schwachstellen in Apache CXF ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Apache CXF ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2682