Description

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-06T12:16:27.953Z",
  "pubdate": "2026-08-06T12:16:27.953Z",
  "executiveSummary": "Apache CXF contains an authentication bypass vulnerability within its OpenID Connect (OIDC) relying-party token validation mechanism. The flaw manifests when processing self-issued ID tokens, where the validation engine fails to enforce critical claim checks including issuer, subject, audience, expiration and issuance time boundaries, alongside sub_jwk cryptographic binding validation. This deficiency allows malicious actors possessing crafted self-issued ID tokens to impersonate valid users and bypass standard authentication controls within the relying party.\nThe vulnerability directly impacts Apache CXF deployments utilizing the OIDC relying-party token validator. Although self-issued ID tokens are disabled by default in the validator configuration, systems where this feature has been explicitly enabled or misconfigured face immediate risk of unauthorized access. Successful exploitation permits attackers to bypass primary authentication layers entirely, granting them unauthorized access to protected resources and downstream services without valid identity provider credentials.\nMitigation requires upgrading the affected Apache CXF framework to the patched versions specified by the vendor, or ensuring that self-issued ID tokens remain disabled if upgrading is not immediately feasible.",
  "technicalDetails": "The vulnerability resides in the Apache CXF OpenID Connect (OIDC) relying-party implementation responsible for processing and validating ID tokens. Specifically, the token validation component fails to properly enforce mandatory security validations when evaluating self-issued ID tokens. Standard OIDC specifications and secure validation routines dictate that ID tokens must undergo rigorous verification of cryptographic signatures, issuer (iss) claims, subject (sub) claims, audience (aud) claims, time-based validity constraints (exp and nbf), and the verification of the subject public key binding (sub_jwk).\nIn the vulnerable versions of Apache CXF, the parsing and validation logic for self-issued ID tokens omits these critical claim verification steps. The root cause is an incomplete validation state machine within the OIDC relying-party validator component that trusts self-issued identity tokens without enforcing structural and cryptographic integrity checks against expected security parameters.\nThe attack flow begins when an attacker constructs a malicious, self-issued ID token containing arbitrary or spoofed claims. Because the Apache CXF OIDC validator does not enforce requisite claim checks or sub_jwk bindings for these tokens, the framework incorrectly accepts the crafted payload as a valid authentication assertion. If the relying party has enabled the acceptance of self-issued ID tokens, the application proceeds to establish an authenticated session for the identity asserted within the forged token, granting the attacker full access privileges associated with the targeted user context.\nPrerequisites for exploitation require that the target Apache CXF instance has self-issued ID tokens enabled within the OIDC validator configuration, as they are disabled by default. The attack vector is network-based, targeting endpoints exposed by the Apache CXF relying party that process OIDC authentication flows. No prior authentication or elevated privileges are required by the attacker, provided they can supply the crafted token to the vulnerable validation routine. Affected software versions include Apache CXF prior to versions 4.2.3, 4.1.8, and 3.6.12."
}