PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-65583 Apache Software Foundation CVE debrief

Apache CXF's OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, self-issued ID tokens are not accepted by default in the validator. The vulnerability's technical impact is significant, as it allows for potential authentication bypass. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue. This CVE record was published on 2026-08-06T12:16:27.953Z and has not been modified since then. Evidence suggests that self-issued ID tokens are not accepted by default in the validator, but users should still take precautions to review OIDC relying-party token validation configurations and monitor for potential authentication bypass attempts.

Vendor
Apache Software Foundation
Product
Apache CXF
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-06
Original CVE updated
2026-08-07
Advisory published
2026-08-06
Advisory updated
2026-08-07

Who should care

Apache CXF users and administrators should be aware of this vulnerability and take steps to upgrade to patched versions. Affected operators, platforms, and security teams should review their configurations and ensure they are not accepting self-issued ID tokens by default. Vulnerability management and security teams should prioritize upgrading to patched versions and review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

Apache CXF's OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, self-issued ID tokens are not accepted by default in the validator. The vulnerability's technical impact is significant, as it allows for potential authentication bypass. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue. Technical details indicate that the vulnerability is related to OIDC relying-party token validation configurations.

Defensive priority

Apache CXF users should prioritize upgrading to patched versions to prevent potential authentication bypass.

Recommended defensive actions

  • Upgrade to Apache CXF version 4.2.3 or 4.1.8 or 3.6.12
  • Review and adjust OIDC relying-party token validation configurations
  • Monitor for potential authentication bypass attempts
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and recommended upgrades. Apache CXF users should verify their deployments and configurations to ensure they are not accepting self-issued ID tokens by default. Defenders should review OIDC relying-party token validation configurations and monitor for potential authentication bypass attempts. The vulnerability's impact is critical, with a CVSS score of 9.1, indicating a high severity. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue. Evidence limits suggest that self-issued ID tokens are not accepted by default in the validator, but users should still take precautions.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T12:16:27.953Z and has not been modified since then.