PUBLISHED
2026-08-06 12:16
MODIFIED
2026-08-06 12:16
EPSS (Prob. Exploit)
0.66%
Top 48.8%
> DESCRIPTION
In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and 'introspection of a revoked token MUST return {"active":false}'. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-672: Operation on a Resource after Expiration or Release - The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider
AFFECTED PACKAGES:
Unknown / Unknown
62 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
06/08/2026 12:16
Source: NVD
📊
ENRICHISSEMENT
01/09/2026 06:02
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-672: Operation on a Resource after Expiration or Release - The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
Total des modifications: 1
Dernière mise à jour: 2 months ago