CyberRota Analysis
AI-GeneratedApache CXF is vulnerable due to its OIDC relying-party token validation, which may improperly accept self-issued ID tokens without enforcing necessary claim checks, potentially allowing attackers to bypass authentication using crafted tokens. This critical vulnerability poses a significant risk to applications relying on Apache CXF for secure token validation. Organizations utilizing affected versions should prioritize upgrading to versions 4.2.3, 4.1.8, or 3.6.12 to mitigate this security threat.
Original NVD Description
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)