Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 22:20:51 +0000 CVE-2026-50627 — Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator https://cve.radiocsirt.org/vuln/cve-2026-50627 <p><strong>Affected:</strong> Apache Software Foundation Apache CXF, Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Web Server 5</p> <p>The JwtAccessTokenValidator class in Apache CXF fails to validate the &#39;aud&#39; (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache CXF, Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Web Server 5</p> <p>The JwtAccessTokenValidator class in Apache CXF fails to validate the &#39;aud&#39; (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-50627