Description

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known or compromised) can thereby substitute the code_challenge, code_challenge_method, nonce, and state values that were set in the outer HTTP request, undermining PKCE integrity and OpenID Connect replay protection. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-06T12:16:27.843Z",
  "pubdate": "2026-08-06T12:16:27.843Z",
  "executiveSummary": "Apache CXF suffers from a vulnerability in the JwtRequestCodeFilter component involving improper handling of claims within signed request JSON Web Tokens (JWTs). The vulnerability arises because the component copies all claims from a signed request JWT directly into the authorization parameter map without excluding security-sensitive parameters.\nThis flaw allows an attacker who can produce a validly-signed request JWT—such as through a known or compromised client_secret—to substitute critical security parameters including code_challenge, code_challenge_method, nonce, and state that were originally established in the outer HTTP request.\nThe impact of this security deficiency includes the undermining of PKCE (Proof Key for Code Exchange) integrity and the circumvention of OpenID Connect replay protection mechanisms.\nThe affected product is Apache CXF. Exploitation requires the attacker to possess or produce a validly-signed request JWT utilizing a compromised or known client secret. Risk implications are significant for deployments relying on OAuth 2.0 PKCE and OpenID Connect protocols, as authorization flow integrity is compromised.\nUsers are strongly recommended to upgrade to secure patched versions to mitigate the identified risks.",
  "technicalDetails": "The vulnerability resides within the JwtRequestCodeFilter component of Apache CXF. The root cause is the insecure design choice of copying all claims from a signed request JWT directly into the authorization parameter map without sanitization or the exclusion of security-sensitive parameters.\nUnder normal protocol operations, parameters such as code_challenge, code_challenge_method, nonce, and state are bound to the outer HTTP request to ensure cryptographic verification of the authorization code exchange and to protect against replay attacks in OpenID Connect.\nIn an exploitation scenario, an attacker who has obtained or knows the valid client_secret can forge or construct a validly-signed request JWT containing arbitrary values for these security-sensitive parameters. When processed by the vulnerable JwtRequestCodeFilter, these injected claims overwrite or supersede the legitimate values set in the outer HTTP request.\nThe step-by-step attack flow proceeds as follows: First, the attacker prepares a signed request JWT containing malicious or manipulated claims for sensitive parameters like code_challenge, code_challenge_method, nonce, and state. Second, the attacker authenticates or interacts with the authorization endpoint using the forged JWT, signed with the compromised client_secret. Third, the Apache CXF application processes the JWT via JwtRequestCodeFilter, blindly extracting and inserting all claims into the internal authorization parameter map. Fourth, the authorization server evaluates the request using the attacker-controlled parameters rather than the original HTTP request parameters.\nThis behavior undermines PKCE integrity by allowing the attacker to bypass or substitute the cryptographic code challenge verification, and it disables OpenID Connect replay protection by allowing manipulation of the nonce and state values.\nThe vulnerability affects Apache CXF versions prior to the provided patches. Authentication requirements depend on the ability to generate a validly-signed JWT using a known or compromised client_secret, operating over network exposure points handling OAuth 2.0 and OpenID Connect authorization requests."
}