Description

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the `c_hash`, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-06T11:16:30.120Z",
  "pubdate": "2026-08-06T11:16:30.120Z",
  "executiveSummary": "Apache CXF relying party implementations contain a vulnerability involving the processing of OpenID Connect Hybrid Flow responses when interacting with non-compliant or misconfigured Identity Providers.\nThe vulnerability type is Authorization Code Substitution and Injection, which arises when the relying party fails to validate the mandatory c_hash parameter due to omission by the Identity Provider.\nThe impact allows attackers to manipulate the authentication flow, potentially leading to unauthorized access and session hijacking.\nAffected systems include Apache CXF relying party deployments utilizing versions prior to 4.2.3, 4.1.8, and 3.6.12.\nRisk implications are significant, as successful exploitation enables malicious actors to inject forged authorization codes into the client session.\nAttacker capabilities require the ability to intercept or manipulate authentication responses during the Hybrid Flow.\nExploitation requirements include the integration of the Apache CXF relying party with a misconfigured or non-compliant Identity Provider that omits the c_hash parameter required by the OpenID Connect Core 1.0 specification.",
  "technicalDetails": "The root cause of the vulnerability stems from the reliance on the Identity Provider to supply the c_hash parameter during the OpenID Connect Hybrid Flow, coupled with insufficient validation logic within the Apache CXF relying party component when this parameter is absent.\nAccording to the OpenID Connect Core 1.0 specification, the relying party must strictly validate the c_hash parameter to cryptographically bind the authorization code to the ID token.\nWhen integrated with an Identity Provider that omits the c_hash parameter, Apache CXF fails to enforce this validation step, creating a cryptographic validation bypass.\nThe exploitation method involves an attacker intercepting a legitimate authentication sequence and substituting the valid authorization code with a malicious or forged authorization code.\nThe attack flow proceeds as follows: First, the attacker initiates an authentication flow or intercepts an ongoing authentication transaction. Second, the Identity Provider issues an ID token without the required c_hash parameter due to misconfiguration or non-compliance. Third, the vulnerable Apache CXF relying party accepts the ID token without verifying the integrity and origin of the authorization code. Fourth, the attacker injects an arbitrary authorization code into the callback handling mechanism. Finally, the relying party processes the injected authorization code as authentic, granting the attacker unauthorized access to the victim's session and associated privileges.\nThe vulnerable component is the OpenID Connect token validation and processing logic within Apache CXF.\nAffected versions include all versions of Apache CXF prior to the patched releases 4.2.3, 4.1.8, and 3.6.12.\nAuthentication requirements and privilege requirements depend on the context of the OAuth 2.0 and OpenID Connect flows, where an external user interaction or interception capability is typically leveraged by the attacker.\nNetwork exposure is inherent to web applications and identity federation endpoints that process incoming OpenID Connect callback parameters over network protocols."
}