Description

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and 'introspection of a revoked token MUST return {"active":false}'. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T12:16:28.183Z",
  "pubdate": "2026-08-06T12:16:28.183Z",
  "executiveSummary": "A vulnerability exists in Apache CXF's DefaultEncryptingOAuthDataProvider where revoked access tokens and refresh tokens continue to decrypt successfully and are incorrectly reported as active by the TokenIntrospectionService.\nThis flaw represents a failure in token state enforcement, directly violating RFC specifications which mandate that authorization servers must invalidate revoked tokens and that token introspection must return active:false for such credentials.\nThe affected product is Apache CXF, with vulnerable components located in the DefaultEncryptingOAuthDataProvider and TokenIntrospectionService implementations.\nThe risk implications include unauthorized resource access, session persistence post-revocation, and potential compliance failures regarding OAuth 2.0 security standards.\nAn attacker who has obtained a previously revoked access or refresh token can continue to leverage it to interact with protected resources or query introspection endpoints without detection.\nNo complex exploitation requirements are specified beyond possessing the revoked cryptographic token material, allowing unauthorized entities to bypass security controls implemented via standard token revocation workflows.",
  "technicalDetails": "The root cause of the vulnerability stems from the DefaultEncryptingOAuthDataProvider component in Apache CXF failing to cross-reference the cryptographic validity or decrypted token state against a persistent revocation store or blacklist mechanism.\nWhen an access token or refresh token is processed, the system relies primarily on the cryptographic decryptability of the token payload rather than validating its current revocation status within the authorization data provider.\nConsequently, even after a formal revocation request is processed, the DefaultEncryptingOAuthDataProvider successfully decrypts the token payload, leading the TokenIntrospectionService to evaluate the token as active and return an active:true response.\nThe attack flow proceeds as follows: First, a legitimate user or administrative entity revokes an issued OAuth access or refresh token. Second, an attacker retains a copy of the revoked token. Third, the attacker presents the revoked token to protected endpoints or queries the TokenIntrospectionService. Fourth, the vulnerable server decrypts the token successfully and incorrectly verifies it as valid. Finally, the attacker maintains unauthorized access to downstream services or misleads relying parties regarding the token status.\nThe affected versions of Apache CXF include those prior to the fixed releases 4.2.3, 4.1.8, and 3.6.12.\nNetwork exposure is inherent to any deployment utilizing Apache CXF for OAuth 2.0 authorization, token management, and introspection services.\nPost-exploitation impact includes prolonged unauthorized access to protected resources, failure to terminate compromised user sessions, and circumvention of identity and access management security boundaries."
}