CVE-2026-50627: Apache CXF Auth Bypass Vulnerability

CVE-2026-50627 Overview

CVE-2026-50627 is a critical authentication weakness in Apache CXF, an open source services framework used to build SOAP, REST, and JAX-WS services. The JwtAccessTokenValidator class does not validate the aud (Audience) claim of incoming JSON Web Token (JWT) access tokens. An attacker can replay a JWT issued for one Resource Server against a different Resource Server, enabling Token Confusion and routing attacks across services that share an identity provider. The flaw is tracked under CWE-289: Authentication Bypass by Alternate Name. Apache addressed the issue in CXF versions 4.2.2 and 4.1.7.

Critical Impact
Attackers holding a valid JWT for any Resource Server in a federation can authenticate to other CXF-based Resource Servers, breaking trust boundaries between services.

Affected Products

Apache CXF versions prior to 4.2.2 in the 4.2.x branch
Apache CXF versions prior to 4.1.7 in the 4.1.x branch
Applications using JwtAccessTokenValidator for OAuth2/JWT bearer token validation

Discovery Timeline

2026-06-12 - CVE-2026-50627 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50627

Vulnerability Analysis

Apache CXF provides OAuth2 and JWT support through its rs-security-oauth2 module. The JwtAccessTokenValidator class is responsible for verifying the signature and claims of bearer JWTs presented to a Resource Server. The validator checks the issuer and expiration but skips audience verification. RFC 7519 requires that when an aud claim is present, the receiving party must reject the token if its identifier is not listed in that claim.

Without this check, any JWT signed by a trusted issuer is accepted regardless of the intended recipient. This collapses the security boundary between independent Resource Servers that delegate authentication to the same authorization server.

Root Cause

The root cause is missing claim validation logic inside JwtAccessTokenValidator. The class trusts that signature verification alone is sufficient to authorize the request. Audience binding, which ties a token to a specific recipient, is absent from the validation pipeline. This is an authentication bypass by alternate name pattern, where a token meant for resource A is silently honored by resource B.

Attack Vector

An attacker requires a valid, non-expired JWT issued for any Resource Server sharing the authorization server. The attacker submits this token in the Authorization: Bearer header of a request to a different CXF Resource Server. Because the audience claim is not checked, the target server accepts the token and grants the privileges associated with the authenticated subject. Exploitation is straightforward over the network and does not require user interaction.

No verified public proof-of-concept code is available. See the Apache mailing list advisory and the Openwall OSS-Security discussion for technical details.

Detection Methods for CVE-2026-50627

Indicators of Compromise

Bearer JWTs presented to CXF endpoints whose decoded aud claim does not match the receiving service identifier
Authentication events for the same subject appearing across multiple Resource Servers within short time windows
Unexpected access to CXF JAX-RS endpoints from clients that historically only consumed other services

Detection Strategies

Decode the JWT presented in inbound requests and compare its aud claim against the expected Resource Server identifier at a gateway or WAF layer
Inventory deployed Apache CXF artifacts by scanning Maven dependencies for cxf-rt-rs-security-oauth2 versions older than 4.2.2 or 4.1.7
Correlate authorization server token issuance logs with Resource Server access logs to detect cross-audience replay

Monitoring Recommendations

Enable verbose logging on org.apache.cxf.rs.security.jose.jwt to capture decoded claims for inbound tokens
Forward CXF access logs to a centralized analytics platform and alert on aud mismatches
Track the version of CXF libraries in production through software bill of materials (SBOM) reporting

How to Mitigate CVE-2026-50627

Immediate Actions Required

Upgrade Apache CXF to version 4.2.2 or 4.1.7 as released by the Apache CXF project
Audit all Resource Servers that share an authorization server and rotate any tokens believed to have been replayed
Enforce short token lifetimes on the authorization server to limit the window of replay

Patch Information

Apache CXF maintainers fixed CVE-2026-50627 in releases 4.2.2 and 4.1.7. The fix adds audience claim validation to JwtAccessTokenValidator so that tokens missing the configured audience are rejected. Upgrade instructions and release notes are available on the Apache CXF announcement thread.

Workarounds

Wrap JwtAccessTokenValidator with a custom validator that explicitly checks the aud claim against the configured Resource Server identifier
Configure an API gateway in front of CXF services to inspect and enforce aud claim binding before forwarding requests
Issue distinct signing keys per Resource Server at the authorization server, preventing cross-service signature reuse

bash

# Maven dependency update example
<dependency>
    <groupId>org.apache.cxf</groupId>
    <artifactId>cxf-rt-rs-security-oauth2</artifactId>
    <version>4.2.2</version>
</dependency>