CVE-2026-50627

The record

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Affected packages

Related vulnerabilities

• CVE-2026-15980 The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all… CWE-289
• CVE-2026-32639 Winter CMS is a content management system built on the Laravel PHP framework. CWE-289
• CVE-2026-15985 The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to… CWE-289
• CVE-2026-9701 The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in… CWE-289
• CVE-2026-55075 Coder allows organizations to provision remote development environments via Terraform. CWE-289
• CVE-2026-56091 When using Apache Shiro with the shiro-guice module in a web servlet context, a specially… CWE-289
• CVE-2026-53622 Traefik is an HTTP reverse proxy and load balancer. CWE-289
• CVE-2026-44492 Axios is a promise based HTTP client for the browser and Node.js. CWE-289