PUBLISHED
2026-08-06 11:16
MODIFIED
2026-08-06 11:16
EPSS (Prob. Exploit)
0.69%
Top 47.6%
> DESCRIPTION
The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the `c_hash`, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-20: Improper Input Validation - The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly.
> RED HAT SECURITY ADVISORIES
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.
Red Hat build of Apache Camel 4.18.4 for Spring Boot patch release and security update is now available.
Red Hat Product Security has rated this update as having a security impact of
Important. A Com...
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow
AFFECTED PACKAGES:
Unknown / Unknown
62 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
06/08/2026 11:16
Source: NVD
📊
ENRICHISSEMENT
01/09/2026 06:02
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-20: Improper Input Validation - The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process...
Total des modifications: 1
Dernière mise à jour: 2 months ago