PatchSiren cyber security CVE debrief
CVE-2026-65583 Apache Software Foundation CVE debrief
Apache CXF's OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, self-issued ID tokens are not accepted by default in the validator. The vulnerability's technical impact is significant, as it allows for potential authentication bypass. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue. This CVE record was published on 2026-08-06T12:16:27.953Z and has not been modified since then. Evidence suggests that self-issued ID tokens are not accepted by default in the validator, but users should still take precautions to review OIDC relying-party token validation configurations and monitor for potential authentication bypass attempts.
- Vendor
- Apache Software Foundation
- Product
- Apache CXF
- CVSS
- CRITICAL 9.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-06
- Original CVE updated
- 2026-08-07
- Advisory published
- 2026-08-06
- Advisory updated
- 2026-08-07
Who should care
Apache CXF users and administrators should be aware of this vulnerability and take steps to upgrade to patched versions. Affected operators, platforms, and security teams should review their configurations and ensure they are not accepting self-issued ID tokens by default. Vulnerability management and security teams should prioritize upgrading to patched versions and review compensating controls for exposed systems while remediation is scheduled and verified.
Technical summary
Apache CXF's OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, self-issued ID tokens are not accepted by default in the validator. The vulnerability's technical impact is significant, as it allows for potential authentication bypass. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue. Technical details indicate that the vulnerability is related to OIDC relying-party token validation configurations.
Defensive priority
Apache CXF users should prioritize upgrading to patched versions to prevent potential authentication bypass.
Recommended defensive actions
- Upgrade to Apache CXF version 4.2.3 or 4.1.8 or 3.6.12
- Review and adjust OIDC relying-party token validation configurations
- Monitor for potential authentication bypass attempts
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
- Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
- Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
Evidence notes
The CVE record and NVD entry provide details on the vulnerability and recommended upgrades. Apache CXF users should verify their deployments and configurations to ensure they are not accepting self-issued ID tokens by default. Defenders should review OIDC relying-party token validation configurations and monitor for potential authentication bypass attempts. The vulnerability's impact is critical, with a CVSS score of 9.1, indicating a high severity. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue. Evidence limits suggest that self-issued ID tokens are not accepted by default in the validator, but users should still take precautions.
Official resources
-
CVE-2026-65583 CVE record
CVE.org
-
CVE-2026-65583 NVD detail
NVD
-
Source item URL
nvd_modified
-
Mitigation or vendor reference
[email protected] - Mailing List, Vendor Advisory
-
Source reference
af854a3a-2127-422b-91ae-364da2661108
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T12:16:27.953Z and has not been modified since then.