CVE-2026-50623

An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/ydzj8m5mqmjy13xgyj9mkk9hfff63qq7	Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/11/3	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:cxf::::::::
	cpe:2.3:a:apache:cxf::::::::

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de omisión de autenticación en el servicio OAuth2 TokenIntrospectionService en Apache CXF. Debido a la ausencia de la palabra clave ’throw’ en la verificación del contexto de seguridad, el endpoint de introspección (/services/oauth2/introspect) puede ser accedido por cualquier atacante de red no autenticado. Sin embargo, tenga en cuenta que esto es una salvaguarda solo en el caso de que alguien olvidara habilitar la autenticación en el servicio. Se recomienda a los usuarios actualizar a la versión 4.2.2 o 4.1.7, que corrige este problema.

Information

Published : 2026-06-12 10:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-50623

Mitre link : CVE-2026-50623

CVE.ORG link : CVE-2026-50623

JSON object : View

Products Affected

apache

cxf

CWE

CWE-287

Improper Authentication

NVD-CWE-noinfo

{"id": "CVE-2026-50623", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50623", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-13T03:55:33.556791Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache CXF", "versions": [{"status": "affected", "version": "4.2.0", "lessThan": "4.2.2", "versionType": "semver"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.1.7", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "3.6.12", "versionType": "semver"}], "packageName": "org.apache.cxf:cxf-rt-rs-security-oauth2", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-06-12T10:16:22.467", "references": [{"url": "https://lists.apache.org/thread/ydzj8m5mqmjy13xgyj9mkk9hfff63qq7", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/11/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF.\u00a0Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service.\u00a0Users are recommended to upgrade to version 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue."}, {"lang": "es", "value": "Existe una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en el servicio OAuth2 TokenIntrospectionService en Apache CXF. Debido a la ausencia de la palabra clave \u2019throw\u2019 en la verificaci\u00f3n del contexto de seguridad, el endpoint de introspecci\u00f3n (/services/oauth2/introspect) puede ser accedido por cualquier atacante de red no autenticado. Sin embargo, tenga en cuenta que esto es una salvaguarda solo en el caso de que alguien olvidara habilitar la autenticaci\u00f3n en el servicio. Se recomienda a los usuarios actualizar a la versi\u00f3n 4.2.2 o 4.1.7, que corrige este problema."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0505632-D713-4EFC-B857-12EBD5C3DF33", "versionEndExcluding": "4.1.7"}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1BF06FC-96AD-4663-9959-1B1493D4A2A0", "versionEndExcluding": "4.2.2", "versionStartIncluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}