PUBLISHED
2026-06-12 10:16
MODIFIED
2026-06-12 10:16
EPSS (Prob. Exploit)
0.37%
Top 69.1%
> DESCRIPTION
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7, which fixes this issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-287: Improper Authentication - When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
> GITHUB SECURITY ADVISORY
GHSA-542g-m3fx-q86f
MODERATE
Apache CXF has Authentication Bypass in OAuth2 TokenIntrospectionService
AFFECTED PACKAGES:
MAVEN / org.apache.cxf:cxf-rt-rs-security-oauth2
< 4.1.7
Fixed in: 4.1.7
MAVEN / org.apache.cxf:cxf-rt-rs-security-oauth2
>= 4.2.0, < 4.2.2
Fixed in: 4.2.2
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
AFFECTED PACKAGES:
Unknown / Unknown
48 versions affected
ALIASES:
GHSA-542g-m3fx-q86f
> HISTORIQUE DES MODIFICATIONS
Première apparition
12/06/2026 10:16
Source: NVD
📊
ENRICHISSEMENT
01/07/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-287: Improper Authentication - When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Total des modifications: 1
Dernière mise à jour: 4 months ago