CVE-2026-63687

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known or compromised) can thereby substitute the code_challenge, code_challenge_method, nonce, and state values that were set in the outer HTTP request, undermining PKCE integrity and OpenID Connect replay protection. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/drcq4chmt0btx86f17o47j17r378hzpw	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/06/22

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:cxf::::::::
	cpe:2.3:a:apache:cxf::::::::
	cpe:2.3:a:apache:cxf::::::::

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El JwtRequestCodeFilter de Apache CXF copia todas las ’claims’ de un JWT de solicitud firmado en el mapa de parámetros de autorización sin excluir los parámetros sensibles a la seguridad. Un cliente que puede producir un JWT de solicitud válidamente firmado (por ejemplo, uno cuyo ’client_secret’ es conocido o ha sido comprometido) puede así sustituir los valores de ’code_challenge’, ’code_challenge_method’, ’nonce’ y ’state’ que se establecieron en la solicitud HTTP externa, socavando la integridad de PKCE y la protección contra ataques de repetición de OpenID Connect. Se recomienda a los usuarios actualizar a las versiones 4.2.3 o 4.1.8 o 3.6.12, que corrigen este problema.

Information

Published : 2026-08-06 12:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-63687

Mitre link : CVE-2026-63687

CVE.ORG link : CVE-2026-63687

JSON object : View

Products Affected

apache

cxf

CWE

CWE-345

Insufficient Verification of Data Authenticity

{"id": "CVE-2026-63687", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63687", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-06T15:18:15.721056Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache CXF", "versions": [{"status": "affected", "version": "4.2.0", "lessThan": "4.2.3", "versionType": "semver"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.1.8", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "3.6.12", "versionType": "semver"}], "packageName": "org.apache.cxf:cxf-rt-rs-security-oauth2", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-08-06T12:16:27.843", "references": [{"url": "https://lists.apache.org/thread/drcq4chmt0btx86f17o47j17r378hzpw", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/06/22", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known or compromised) can thereby substitute the code_challenge, code_challenge_method, nonce, and state values that were set in the outer HTTP request, undermining PKCE integrity and OpenID Connect replay protection. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue."}, {"lang": "es", "value": "El JwtRequestCodeFilter de Apache CXF copia todas las \u2019claims\u2019 de un JWT de solicitud firmado en el mapa de par\u00e1metros de autorizaci\u00f3n sin excluir los par\u00e1metros sensibles a la seguridad. Un cliente que puede producir un JWT de solicitud v\u00e1lidamente firmado (por ejemplo, uno cuyo \u2019client_secret\u2019 es conocido o ha sido comprometido) puede as\u00ed sustituir los valores de \u2019code_challenge\u2019, \u2019code_challenge_method\u2019, \u2019nonce\u2019 y \u2019state\u2019 que se establecieron en la solicitud HTTP externa, socavando la integridad de PKCE y la protecci\u00f3n contra ataques de repetici\u00f3n de OpenID Connect. Se recomienda a los usuarios actualizar a las versiones 4.2.3 o 4.1.8 o 3.6.12, que corrigen este problema."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09753EF1-BB56-4238-8ED7-609E2AB5EB05", "versionEndExcluding": "3.6.12"}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "801F031C-B5F5-4CF5-B9A5-DD9AA2F76A66", "versionEndExcluding": "4.1.8", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A112761E-E622-4AE5-9BE6-47A247021D4F", "versionEndExcluding": "4.2.3", "versionStartIncluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}