PT-2026-48846 · Apache · Apache Cxf

Guanping Zhang · CVE-2026-50627 · Published 2026-06-12 · Updated 2026-06-16

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.2 Apache CXF versions prior to 4.1.7

Description The JwtAccessTokenValidator class fails to validate the aud (Audience) claims of incoming JWT access tokens. This flaw enables a JWT issued for one Resource Server to be replayed against a different Resource Server, resulting in Token Confusion or Routing attacks.

Recommendations Upgrade to version 4.2.2. Upgrade to version 4.1.7.

Exploit

Fix

Weakness Enumeration

CWE-289

CWE-303

Related Identifiers

CVE-2026-50627

Affected Products

Apache Cxf

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50627.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-50627 · Vendor Advisory
• https://lists.apache.org/thread/0jfzz9q992957b99tw7hodcqjfyxwb1m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-50627 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-50627 · Note
• https://twitter.com/infoflowcloud/status/2065463121783685328 · Twitter Post
• http://openwall.com/lists/oss-security/2026/06/11/4 · Note
• https://twitter.com/CVEnew/status/2065461541260984720 · Twitter Post
• https://t.me/CVEtracker/56689 · Telegram Post
• https://repo.maven.apache.org/maven2 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2488298 · Note
• https://t.me/cveNotify/167480 · Telegram Post
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50627.json · Note